PT-2023-23568 · WordPress · Mstore Api

Truoc Phan · Publicado 2023-07-12 · Atualizado 2023-07-19 · CVE-2023-3202

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress (affected versions not specified)

Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update firebase server key function. This allows unauthenticated attackers to update the firebase server key for push notifications when the order status changes via a forged request, provided they can trick a site administrator into performing an action like clicking on a link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-3202

Produtos afetados

Mstore Api

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-3202 · Aviso do Fabricante
• https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L232 · Correção
• https://wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3202 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail= · Correção
• https://t.me/cibsecurity/66514 · Publicação no Telegram
• https://t.me/cvenotify/54662 · Publicação no Telegram