PT-2023-25111 · WordPress · Web Push Notifications

Theodoros Malachias · Publicado 2023-11-13 · Atualizado 2023-11-17 · CVE-2023-35041

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webpushr Web Push Notifications plugin versions <= 4.34.0

Description The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that can lead to Local File Inclusion (LFI). This means an attacker could potentially trick a user into performing unintended actions on the web application, which in turn could allow the inclusion of local files, potentially revealing sensitive information.

Recommendations For Webpushr Web Push Notifications plugin versions <= 4.34.0, update to a version higher than 4.34.0 to resolve the issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-35041

Produtos afetados

Web Push Notifications

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-35041 · Nota de Segurança
• https://patchstack.com/database/vulnerability/webpushr-web-push-notifications/wordpress-web-push-notifications-webpushr-plugin-4-34-0-csrf-leading-to-lfi-vulnerability?_s_id=cve · Nota
• https://osv.dev/vulnerability/CVE-2023-35041 · Aviso do Fabricante