PT-2023-21137 · WordPress · Wordpress

Matt Rusnak + 2 · Publicado 2023-05-17 · Atualizado 2024-05-08 · CVE-2023-2745

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Core versions up to, and including, 6.2

Description The issue allows unauthenticated attackers to access and load arbitrary translation files via the wp lang parameter, potentially leading to a Cross-Site Scripting attack if a crafted translation file is uploaded to the site.

Recommendations For WordPress Core versions up to, and including, 6.2, consider restricting access to the wp lang parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using upload forms that could allow attackers to upload crafted translation files.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BIT-WORDPRESS-2023-2745

BIT-WORDPRESS-MULTISITE-2023-2745

CVE-2023-2745

DLA-3462-1

DSA-5685-1

Produtos afetados

Wordpress

Referências · 22

• 🔥 https://exploit-db.com/exploits/52274 · Exploit
• https://t.me/cvenotify/50679 · Publicação no Telegram
• https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-2745 · Nota de Segurança
• https://t.me/cvenotify/52754 · Publicação no Telegram
• https://t.me/cibsecurity/64301 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2023-2745 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-3462-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-2745 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html · Nota
• https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2745 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-2745 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-2745 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-5685-1 · Aviso do Fabricante