PT-2023-32209 · WordPress · Chatbot

Huynh Tien Si · Publicado 2023-11-02 · Atualizado 2023-11-09 · CVE-2023-5606

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The ChatBot for WordPress versions 4.8.6 through 4.9.6

Description The issue arises from insufficient input sanitization and output escaping in the FAQ Builder, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts. This affects multi-site installations and installations where unfiltered html has been disabled, enabling the execution of injected scripts when a user accesses the affected page.

Recommendations For versions 4.8.6 through 4.9.6, update to a version that addresses the insufficient input sanitization and output escaping in the FAQ Builder to prevent stored cross-site scripting attacks.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-5606

Produtos afetados

Chatbot

Referências · 6

• https://t.me/cibsecurity/73414 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-5606 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-5606 · Nota de Segurança
• https://t.me/cvenotify/60357 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987335%40chatbot%2Ftrunk&old=2986133%40chatbot%2Ftrunk&sfp_email=&sfph_mail= · Correção