PT-2023-30158 · WordPress · Ad Inserter

Marco Wotschka · Publicado 2023-10-20 · Atualizado 2023-10-27 · CVE-2023-4668

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Ad Inserter for WordPress versions up to, and including, 2.7.30

Description The issue allows unauthenticated attackers to extract sensitive data including installed plugins, active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit and installation paths. This is achieved via the ai-debug-processing-fe URL parameter.

Recommendations For versions up to, and including, 2.7.30, consider disabling the ai-debug-processing-fe URL parameter until a patch is available to prevent sensitive information exposure. Restrict access to sensitive data and server settings to minimize the risk of exploitation. Update to a version higher than 2.7.30 when available.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-4668

Produtos afetados

Ad Inserter

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-4668 · Aviso do Fabricante
• https://t.me/cibsecurity/72673 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1715328034075451738 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk · Correção
• https://wordfence.com/threat-intel/vulnerabilities/id/ce457c98-c55b-4b71-a80b-393eceb9effd?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-4668 · Nota de Segurança
• https://t.me/cvenotify/59793 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1715271093521363233 · Publicação no Twitter