PT-2023-16184 · WordPress · Correos Oficial

Andrea Iodice · Publicado 2023-02-27 · Atualizado 2025-03-10 · CVE-2023-0331

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Correos Oficial WordPress plugin versions 1.2.0.2 and earlier

Description The issue allows unauthenticated attackers to download arbitrary files from the server due to a lack of authorization check and user input validation when generating a file path.

Recommendations For Correos Oficial WordPress plugin versions 1.2.0.2 and earlier, update to a version that includes the necessary authorization checks and input validation to prevent arbitrary file downloads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2023-0331

Produtos afetados

Correos Oficial

Referências · 5

• 🔥 https://wpscan.com/vulnerability/1b4dbaf3-1364-4103-9a7b-b5a1355c685b · Exploit
• https://t.me/cvenotify/114114 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0331 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0331 · Aviso do Fabricante
• https://t.me/cvenotify/45497 · Publicação no Telegram