PT-2023-17291 · WordPress · Limit Login Attempts

Marc Montpas · CVE-2023-1861 · Publicado 2023-05-02 · Atualizado 2023-05-08

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Limit Login Attempts WordPress plugin versions 1.7.2 and earlier

Description The issue concerns the Limit Login Attempts WordPress plugin, where it fails to sanitize and escape usernames when outputting them back in the logs dashboard. This could allow any authenticated users, such as subscribers, to perform Stored Cross-Site Scripting attacks.

Recommendations For Limit Login Attempts WordPress plugin versions 1.7.2 and earlier, update to a version later than 1.7.2 to resolve the issue. As a temporary workaround, consider restricting access to the logs dashboard to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-1861

Produtos afetados

Limit Login Attempts

Referências · 5

• 🔥 https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1861 · Aviso do Fabricante
• https://t.me/cvenotify/49977 · Publicação no Telegram
• https://t.me/cvenotify/49604 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-1861 · Nota de Segurança