PT-2023-31813 · Unknown · Piotnet Forms

Rafie Muhammad · Publicado 2023-12-29 · Atualizado 2024-01-05 · CVE-2023-51412

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piotnet Forms versions 1.0.25 and earlier

Description The issue is related to an Unrestricted Upload of File with Dangerous Type. This allows for the upload of files with potentially dangerous types, which could lead to security issues.

Recommendations For versions 1.0.25 and earlier, consider restricting file uploads to only allow safe file types until a patch is available. As a temporary workaround, consider disabling file upload functionality in Piotnet Forms until a patch is available. Restrict access to the file upload module to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-51412

Produtos afetados

Piotnet Forms

Referências · 7

• https://twitter.com/CVEnew/status/1740738146827170288 · Publicação no Twitter
• https://patchstack.com/database/vulnerability/piotnetforms/wordpress-piotnetforms-plugin-1-0-25-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve · Nota
• https://t.me/cibsecurity/73982 · Publicação no Telegram
• https://t.me/cvenotify/65669 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1740757756682944592 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-51412 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-51412 · Nota de Segurança