PT-2023-21697 · Unknown · Mw Wp Form

Shuya Ota · Publicado 2023-05-23 · Atualizado 2025-01-31 · CVE-2023-28409

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MW WP Form versions v4.4.2 and earlier

Description The issue allows a remote unauthenticated attacker to upload an arbitrary file due to an unrestricted upload of files with dangerous types. This may lead to potential security risks.

Recommendations For MW WP Form versions v4.4.2 and earlier, update to a version later than v4.4.2 to resolve the issue. As a temporary workaround, consider restricting file uploads to only allow safe file types until a patch is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-28409

Produtos afetados

Mw Wp Form

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28409 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28409 · Aviso do Fabricante
• https://t.me/cvenotify/109418 · Publicação no Telegram
• https://plugins.2inc.org/mw-wp-form/blog/2023/05/08/752 · Aviso do Fabricante
• https://t.me/cibsecurity/64593 · Publicação no Telegram
• https://t.me/cvenotify/50953 · Publicação no Telegram
• https://jvn.jp/en/jp/JVN01093915 · Nota