PT-2020-13632 · Siteorigin · Siteorigin Page Builder

Published 2020-05-28 · Updated 2020-05-28 · CVE-2020-13642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteOrigin Page Builder plugin versions prior to 2.10.16

Description An issue was discovered in the SiteOrigin Page Builder plugin, where the action builder content function did not perform nonce verification, allowing requests to be forged on behalf of an administrator. The panels data $ POST variable allows for malicious JavaScript to be executed in the victim's browser.

Recommendations For versions prior to 2.10.16, update to version 2.10.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the action builder content function until a patch is available. Avoid using the panels data variable in the affected plugin until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-13642

Affected Products

Siteorigin Page Builder

References · 5

• 🔥 https://wordfence.com/blog/2020/05/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites · Exploit
• https://osv.dev/vulnerability/CVE-2020-13642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13642 · Security Note
• https://t.me/cvenotify/4058 · Telegram Post
• https://wordpress.org/plugins/siteorigin-panels/#developers · Note