PT-2023-32595 · WordPress · Siteorigin Widgets Bundle

Sebastian Neef · Publicado 2023-12-12 · Atualizado 2024-01-03 · CVE-2023-6295

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteOrigin Widgets Bundle WordPress plugin versions prior to 1.51.0

Description The issue allows users with the administrator role to perform Local File Inclusion (LFI) attacks in the context of Multisite WordPress sites. This is due to the plugin not validating user input before using it to generate paths passed to include function/s.

Recommendations For versions prior to 1.51.0, update to version 1.51.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for users with the administrator role until the update is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-6295

Produtos afetados

Siteorigin Widgets Bundle

Referências · 10

• 🔥 https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c · Exploit
• https://t.me/cvenotify/64758 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-6295 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1736842767341326354 · Publicação no Twitter
• https://t.me/cybersecuritytechnologies/9594 · Publicação no Telegram
• https://twitter.com/Dinosn/status/1734907720212328945 · Publicação no Twitter
• https://twitter.com/Dinosn/status/1742579039745843581 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6295 · Nota de Segurança
• https://twitter.com/gehaxelt/status/1734628178524594400 · Publicação no Twitter
• https://t.me/freedomf0x/20785 · Publicação no Telegram