PT-2023-29584 · WordPress · Jeff Starr User Submitted Posts

Rafie Muhammad · Publicado 2023-10-16 · Atualizado 2023-12-27 · CVE-2023-45603

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End versions n/a through 20230902

Description The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the specified software. This allows for the upload of files with potentially dangerous types, posing a security risk.

Recommendations For versions n/a through 20230902, update to a version later than 20230902 to resolve the issue. As a temporary workaround, consider restricting file uploads to only safe and necessary file types until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-45603

Produtos afetados

Jeff Starr User Submitted Posts

Referências · 8

• 🔥 https://github.com/codeb0ss/CVE-2023-45603-PoC · Exploit
• https://twitter.com/CVEnew/status/1737546528145760533 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-45603 · Nota de Segurança
• https://patchstack.com/database/vulnerability/user-submitted-posts/wordpress-user-submitted-posts-plugin-20230902-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve · Nota
• https://t.me/cvenotify/64480 · Publicação no Telegram
• https://t.me/cvenotify/65266 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-45603 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/9208 · Publicação no Telegram