PT-2023-31321 · Unknown · Spiffy Calendar

Resecured.Io · Publicado 2023-12-14 · Atualizado 2023-12-19 · CVE-2023-49745

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Spiffy Calendar versions through 4.9.5

Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or other malicious activities.

Recommendations For versions through 4.9.5, update to a version later than 4.9.5 to resolve the issue. As a temporary workaround, consider restricting access to the Spiffy Calendar plugin to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-49745

Produtos afetados

Spiffy Calendar

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-49745 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1735309176874913844 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-49745 · Nota de Segurança
• https://twitter.com/RedPacketSec/status/1737051442626642385 · Publicação no Twitter
• https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota