PT-2023-16555 · WordPress · Underconstruction

Alex Thomas + 2 · Publicado 2023-06-09 · Atualizado 2023-06-14 · CVE-2023-0831

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Under Construction plugin for WordPress versions up to and including 3.96

Description The issue arises from missing or incorrect nonce validation on the dismiss notice function, which is called via the admin action ucp dismiss notice action. This allows unauthenticated attackers to dismiss plugin notifications by tricking a site administrator into performing an action, such as clicking on a link, thereby facilitating a Cross-Site Request Forgery attack.

Recommendations For Under Construction plugin for WordPress versions up to and including 3.96, update to a version that includes proper nonce validation for the dismiss notice function to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to the admin action ucp dismiss notice action to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-0831

Produtos afetados

Underconstruction

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-0831 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/under-construction-page/trunk/under-construction.php?rev=2848705#L901 · Correção
• https://wordfence.com/threat-intel/vulnerabilities/id/031a1203-6b0d-453b-be8a-12e7f55cb401?source=cve · Nota
• https://osv.dev/vulnerability/CVE-2023-0831 · Aviso do Fabricante