PT-2023-24098 · Elementor · Unlimited Elements For Elementor

Chloe Chamberland + 1 · CVE-2023-3295 · Publicado 2023-06-17 · Atualizado 2024-10-14

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Unlimited Elements For Elementor versions up to, and including, 1.5.66

Description The issue is related to arbitrary file uploads due to missing file type validation in the file manager functionality. This allows authenticated attackers with contributor-level permissions and above to upload arbitrary files on the affected site's server, potentially enabling remote code execution.

Recommendations For versions up to, and including, 1.5.66, update to version 1.5.67 to fully patch the issue. As a temporary workaround, consider restricting file uploads in the file manager functionality until the issue is resolved.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-3295

Produtos afetados

Unlimited Elements For Elementor

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/ce1ac711-6026-49ef-b66b-2cc199697942?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_assets.class.php#L1005 · Nota
• https://t.me/cvenotify/52552 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3295 · Nota de Segurança
• https://t.me/cvenotify/90742 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3295 · Aviso do Fabricante