PT-2023-30719 · WordPress · Shared Files

Zeyad Alshahrani · Publicado 2023-10-16 · Atualizado 2023-10-20 · CVE-2023-4819

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Shared Files WordPress plugin versions prior to 1.7.6

Description The issue arises from the plugin not returning the correct Content-Type header for uploaded files, allowing an attacker to upload files with allowed extensions that contain malicious scripts.

Recommendations For versions prior to 1.7.6, update to version 1.7.6 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to trusted users or disabling the file upload feature until the update is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-4819

Produtos afetados

Shared Files

Referências · 5

• 🔥 https://wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a · Exploit
• https://osv.dev/vulnerability/CVE-2023-4819 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1714051980052631663 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1714006548643516729 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4819 · Nota de Segurança