PT-2023-27194 · Std.Cloud · Wxsync Plugin

Rio Darmawan · Publicado 2023-09-04 · Atualizado 2023-09-06 · CVE-2023-39988

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions std.Cloud WxSync plugin versions <= 2.7.23

Description A Stored Cross-Site Scripting (XSS) vulnerability exists, allowing authenticated contributors to inject malicious scripts. The issue affects versions of the WxSync plugin up to and including 2.7.23.

Recommendations For std.Cloud WxSync plugin versions <= 2.7.23, update to a version later than 2.7.23 to resolve the issue. As a temporary workaround, consider restricting access to the WxSync plugin until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-39988

Produtos afetados

Wxsync Plugin

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-39988 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1698679265837846821 · Publicação no Twitter
• https://patchstack.com/database/vulnerability/wxsync/wordpress-wxsync-plugin-2-7-23-cross-site-scripting-xss?_s_id=cve · Nota
• https://twitter.com/CVEnew/status/1698645291023397316 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-39988 · Aviso do Fabricante
• https://t.me/cibsecurity/69756 · Publicação no Telegram