PT-2023-30602 · Automattic · Woocommerce Blocks+1

Rafie Muhammad · Publicado 2023-11-30 · Atualizado 2023-12-05 · CVE-2023-47777

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WooCommerce versions through 8.1.1 WooCommerce Blocks versions through 11.1.1

Description The issue affects Automattic WooCommerce and Automattic WooCommerce Blocks, allowing Stored XSS due to improper neutralization of input during web page generation. This is a Cross-site Scripting vulnerability.

Recommendations For WooCommerce versions through 8.1.1, update to a version later than 8.1.1 to resolve the issue. For WooCommerce Blocks versions through 11.1.1, update to a version later than 11.1.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the web application to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-47777

Produtos afetados

Woocommerce

Woocommerce Blocks

Referências · 9

• 🔥 https://patchstack.com/articles/authenticated-stored-xss-in-woocommerce-and-jetpack-plugin?_s_id=cve · Exploit
• https://twitter.com/CVEnew/status/1730202468246757677 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-47777 · Aviso do Fabricante
• https://t.me/cvenotify/61630 · Publicação no Telegram
• https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-1-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-47777 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1730218403061768401 · Publicação no Twitter
• https://t.me/cvenotify/62361 · Publicação no Telegram
• https://patchstack.com/database/vulnerability/woo-gutenberg-products-block/wordpress-woocommerce-blocks-plugin-11-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota