PT-2023-6979 · Unknown · Newsletters

Gen Sato · Publicado 2023-05-09 · Atualizado 2023-05-30 · CVE-2023-27922

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Newsletter versions prior to 7.6.9

Description The issue is a cross-site scripting vulnerability that allows a remote unauthenticated attacker to inject an arbitrary script. This can be exploited to conduct cross-site scripting attacks. The vulnerability exists due to inadequate protection of the web page structure.

Recommendations For versions prior to 7.6.9, update to version 7.6.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Newsletter plugin to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-07998

CVE-2023-27922

Produtos afetados

Newsletters

Referências · 6

• https://jvn.jp/en/jp/JVN59341308 · Nota
• https://t.me/cvenotify/50962 · Publicação no Telegram
• https://wordpress.org/plugins/newsletter · Nota
• https://bdu.fstec.ru/vul/2023-07998 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-27922 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27922 · Aviso do Fabricante