PT-2023-28700 · WordPress · Vrm 360 3D Model Viewer

0Xp1P3 + 1 · Publicado 2023-12-18 · Atualizado 2023-12-21 · CVE-2023-4311

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vrm 360 3D Model Viewer WordPress plugin versions 1.2.1 and earlier

Description The issue arises from insufficient checks in a plugin shortcode, allowing for arbitrary file upload.

Recommendations For Vrm 360 3D Model Viewer WordPress plugin versions 1.2.1 and earlier, consider disabling the vulnerable shortcode until a patch is available to prevent arbitrary file uploads.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-4311

Produtos afetados

Vrm 360 3D Model Viewer

Referências · 4

• 🔥 https://wpscan.com/vulnerability/21950116-1a69-4848-9da0-e912096c0fce · Exploit
• https://twitter.com/CVEnew/status/1736842770835214806 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4311 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4311 · Nota de Segurança