PT-2023-23569 · WordPress · Mstore Api

Truoc Phan · Publicado 2023-06-14 · Atualizado 2023-06-20 · CVE-2023-3203

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress (affected versions not specified)

Description The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore update limit product function. This makes it possible for unauthenticated attackers to update the limit of the number of products per category to use cache data in the home screen via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-3203

Produtos afetados

Mstore Api

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/1aed51a2-9fd4-43bb-b72d-ae8e51ee6e87?source=cve · Nota
• https://t.me/cvenotify/52746 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3203 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L222 · Correção
• https://t.me/cibsecurity/65224 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail= · Correção
• https://osv.dev/vulnerability/CVE-2023-3203 · Aviso do Fabricante