PT-2023-17387 · WordPress · Web Stories For Wordpress

Swissspidy · Publicado 2023-05-08 · Atualizado 2023-11-01 · CVE-2023-1979

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Web Stories for WordPress versions prior to 1.32

Description The Web Stories for WordPress plugin has a vulnerability that allows users with the "Author" role to bypass permission checks and access password-protected content. Normally, users with this role cannot edit password-protected stories, but the vulnerability enables them to duplicate protected stories in the plugin's dashboard, giving them access to the content.

Recommendations For versions prior to 1.32, upgrade to version 1.32 or beyond to resolve the issue. As a temporary workaround, consider restricting access to the plugin's dashboard for users with the "Author" role until the update is applied.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-1979

Produtos afetados

Web Stories For Wordpress

Referências · 9

• https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 · Correção
• https://github.com/GoogleForCreators/web-stories-wp · Nota
• https://github.com/GoogleForCreators/web-stories-wp/releases/tag/v1.32.0 · Nota
• https://osv.dev/vulnerability/CVE-2023-1979 · Aviso do Fabricante
• https://t.me/cvenotify/50340 · Publicação no Telegram
• https://t.me/cvenotify/49953 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-1979 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1979 · Nota
• https://t.me/cibsecurity/63449 · Publicação no Telegram