PT-2023-21254 · David F. Carr · Rsvpmaker Plugin

Muhammad Arsalan Diponegoro · Publicado 2023-09-26 · Atualizado 2023-09-29 · CVE-2023-27616

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions David F. Carr RSVPMaker plugin versions <= 10.6.6

Description The issue is an Unauth. Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker can inject malicious scripts into the application, which can then be executed by other users. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For David F. Carr RSVPMaker plugin versions <= 10.6.6, update to a version higher than 10.6.6 to resolve the issue. As a temporary workaround, consider restricting access to the plugin until a patch is available. Avoid using the plugin for sensitive operations until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-27616

Produtos afetados

Rsvpmaker Plugin

Referências · 5

• https://twitter.com/CVEnew/status/1706906544955437233 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-27616 · Aviso do Fabricante
• https://twitter.com/cracbot/status/1707273978572931472 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-27616 · Nota de Segurança
• https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-6-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve · Nota