PT-2023-30424 · Unknown · Swiftyedit Content Management System

Mechaneus · Publicado 2023-11-22 · Atualizado 2024-01-24 · CVE-2023-47350

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SwiftyEdit Content Management System versions prior to 1.2.0

Description The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which allows remote attackers to escalate privileges via the user password update functionality. This can be exploited by attackers to gain unauthorized access to user accounts.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider disabling the user password update functionality until a patch is available. Restrict access to the user account management module to minimize the risk of exploitation. Avoid using the password variable in the affected API endpoint until the issue is resolved.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-47350

GHSA-2492-XXQF-6H78

Produtos afetados

Swiftyedit Content Management System

Referências · 9

• https://github.com/SwiftyEdit/SwiftyEdit/commit/90a6f3df16cd1578b2827d7b2e073451f7ce4e47 · Correção
• https://github.com/SwiftyEdit/SwiftyEdit · Nota
• https://twitter.com/VulmonFeeds/status/1731729185138176475 · Publicação no Twitter
• https://t.me/cvenotify/61396 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-47350 · Nota de Segurança
• https://mechaneus.github.io/CVE-2023-47350.html · Nota
• https://t.me/cvenotify/68480 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-47350 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2492-xxqf-6h78 · Aviso do Fabricante