PT-2023-30029 · WordPress · Ad Inserter

Marco Wotschka · Publicado 2023-10-18 · Atualizado 2023-10-25 · CVE-2023-4645

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ad Inserter for WordPress versions up to, and including, 2.7.30

Description The issue allows unauthenticated attackers to extract sensitive data such as post titles and slugs, including those of protected posts along with their passwords, usernames, available roles, and the plugin license key, provided the remote debugging option is enabled. The remote debugging option is disabled by default. This is achieved via the ai ajax function.

Recommendations For versions up to, and including, 2.7.30, consider disabling the ai ajax function until a patch is available. Additionally, ensure the remote debugging option remains disabled to minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-4645

Produtos afetados

Ad Inserter

Referências · 8

• https://twitter.com/CVEnew/status/1714830282598101329 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4645 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/ad-inserter/trunk/ad-inserter.php#L6529 · Correção
• https://osv.dev/vulnerability/CVE-2023-4645 · Aviso do Fabricante
• https://t.me/cibsecurity/72546 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1714880294849851428 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/57b3eef3-e165-45ac-89d7-2a2a6529b310?source=cve · Nota