PT-2023-27245 · Unknown · Advanced Custom Fields Pro

Ryotaro Imamura

+1

·

Publicado

2023-08-21

·

Atualizado

2023-08-25

·

CVE-2023-40068

CVSS v3.1

5.4

Média

VetorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Advanced Custom Fields versions 6.1.0 through 6.1.7 Advanced Custom Fields Pro versions 6.1.0 through 6.1.7
Description A cross-site scripting vulnerability allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with administrative privilege. This issue potentially affects approximately 1 million sites.
Recommendations For Advanced Custom Fields versions 6.1.0 through 6.1.7, update to a version later than 6.1.7 to resolve the issue. For Advanced Custom Fields Pro versions 6.1.0 through 6.1.7, update to a version later than 6.1.7 to resolve the issue. As a temporary workaround, consider restricting access to administrative privileges until a patch is applied.

Correção

RCE

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-40068

Produtos afetados

Advanced Custom Fields Pro