PT-2023-31977 · WordPress · Chatbot

Marco Wotschka · CVE-2023-5254 · Publicado 2023-10-18 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ChatBot plugin for WordPress versions up to, and including, 4.8.9

Description The issue allows unauthenticated attackers to extract sensitive data, including confirmation of whether a user name exists on the site and order information for existing users, via the qcld wb chatbot check user function.

Recommendations For versions up to, and including, 4.8.9, consider disabling the qcld wb chatbot check user function as a temporary workaround until a patch is available. Update to a version later than 4.8.9 to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-5254

Produtos afetados

Chatbot

Referências · 8

• 🔥 https://plugins.trac.wordpress.org/browser/chatbot/trunk/functions.php#L1224 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-5254 · Nota de Segurança
• https://t.me/cvenotify/59968 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= · Correção
• https://twitter.com/CVEnew/status/1714882299463086345 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1714956117770371543 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/d897daf8-5320-4546-9a63-1d34a15b2a58?source=cve · Nota
• https://osv.dev/vulnerability/CVE-2023-5254 · Aviso do Fabricante