PT-2023-22496 · WordPress · Jetpack

Miguel Neto · Publicado 2023-06-27 · Atualizado 2023-07-03 · CVE-2023-2996

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jetpack WordPress plugin versions prior to 12.1.1

Description The issue allows users with author roles or above to manipulate existing files on the site, including deleting arbitrary files. In rare cases, it can also lead to Remote Code Execution via phar deserialization due to the lack of validation for uploaded files.

Recommendations For versions prior to 12.1.1, update to version 12.1.1 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities to higher roles until the update can be applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-2996

Produtos afetados

Jetpack

Referências · 5

• 🔥 https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2996 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2996 · Nota
• https://osv.dev/vulnerability/CVE-2023-2996 · Aviso do Fabricante
• https://jetpack.com/blog/jetpack-12-1-1-critical-security-update · Aviso do Fabricante