PT-2023-31126 · WordPress · Bear

Marco Wotschka · Publicado 2023-10-20 · Atualizado 2023-10-25 · CVE-2023-4924

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions The BEAR for WordPress versions up to, and including, 1.1.3.3

Description The issue is due to missing capability checks on the woobe bulkoperations delete function, making it possible for authenticated attackers with subscriber access or higher to delete products.

Recommendations For versions up to, and including, 1.1.3.3, update to a version that includes the necessary capability checks for the woobe bulkoperations delete function to prevent unauthorized product deletion. As a temporary workaround, consider restricting access to the woobe bulkoperations delete function until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-4924

Produtos afetados

Bear

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/7dfd0246-4265-4dde-8a1e-18b7042eae74?source=cve · Nota
• https://t.me/cibsecurity/72679 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-4924 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-4924 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1715271113121403372 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L344 · Nota