PT-2023-17407 · WordPress · Pretty Url

Shezad Master · Publicado 2023-05-15 · Atualizado 2025-01-14 · CVE-2023-2009

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pretty Url WordPress plugin versions 1.5.4 and earlier

Description The issue arises from the plugin's failure to sanitize and escape the URL field in its settings, potentially allowing high-privilege users to perform Stored Cross-Site Scripting attacks. This vulnerability can be exploited even when the unfiltered html capability is disallowed, such as in a multisite setup.

Recommendations For versions 1.5.4 and earlier, as a temporary workaround, consider disabling the URL field in the plugin settings until a patch is available. Restrict access to the plugin's settings to minimize the risk of exploitation. Avoid using the URL field in the affected plugin settings until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-2009

Produtos afetados

Pretty Url

Referências · 6

• 🔥 https://wpscan.com/vulnerability/f7988a18-ba9d-4ead-82c8-30ea8223846f · Exploit
• https://t.me/cvenotify/50442 · Publicação no Telegram
• https://t.me/cvenotify/50993 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2009 · Nota de Segurança
• https://t.me/cibsecurity/64121 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2009 · Aviso do Fabricante