PT-2023-30650 · WordPress · Wpforo Forum

Jesse Mcneil · Publicado 2023-11-30 · Atualizado 2023-12-06 · CVE-2023-47870

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wpForo Forum versions through 2.2.6

Description The issue is related to Cross-Site Request Forgery (CSRF) and Missing Authorization, allowing unauthorized access to functionality not properly constrained by Access Control Lists (ACLs). This can lead to forced log out of all users.

Recommendations For versions through 2.2.6, update to a version that includes a fix for this issue to prevent Cross-Site Request Forgery and unauthorized access. As a temporary workaround, consider restricting access to sensitive functionality to minimize the risk of exploitation.

Correção

Missing Authorization

CSRF

Enumeração de Fraquezas

CWE-862

CWE-352

Identificadores relacionados

CVE-2023-47870

Produtos afetados

Wpforo Forum

Referências · 7

• https://twitter.com/VulmonFeeds/status/1730310512326451451 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-47870 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47870 · Nota de Segurança
• https://twitter.com/CVEnew/status/1730296122961490140 · Publicação no Twitter
• https://t.me/cvenotify/61740 · Publicação no Telegram
• https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Nota
• https://t.me/cvenotify/62523 · Publicação no Telegram