PT-2023-16569 · WordPress · Woocommerce Multiple Customer Addresses & Shipping

Johannes Ludwig + 2 · Publicado 2023-03-20 · Atualizado 2023-03-23 · CVE-2023-0865

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce Multiple Customer Addresses & Shipping WordPress plugin versions prior to 21.7

Description The issue allows any authenticated user to add, update, duplicate, delete, and retrieve addresses of other users, due to insufficient validation of user privileges. This affects users with low privileges, such as subscribers.

Recommendations For versions prior to 21.7, update to version 21.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the address management functionality to high-privilege users until the update is applied.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-0865

Produtos afetados

Woocommerce Multiple Customer Addresses & Shipping

Referências · 5

• 🔥 https://wpscan.com/vulnerability/e39c0171-ed4a-4143-9a31-c407e3555eec · Exploit
• https://osv.dev/vulnerability/CVE-2023-0865 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0865 · Nota de Segurança
• https://t.me/cvenotify/46505 · Publicação no Telegram
• https://t.me/cibsecurity/60339 · Publicação no Telegram