PT-2023-11869 · Unknown · Newsletter Manager

Jerome Bruandet · CVE-2020-36727 · Published 2023-06-07 · Updated 2023-06-13

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Newsletter Manager versions up to, and including, 1.5.1

Description The issue is related to insecure deserialization. This is caused by unsanitized input from the customFieldsDetails parameter being passed through a deserialization function, potentially allowing unauthenticated attackers to inject a serialized PHP object.

Recommendations For versions up to, and including, 1.5.1, update to a version that fixes the insecure deserialization issue. As a temporary workaround, consider restricting access to the customFieldsDetails parameter to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-36727

Affected Products

Newsletter Manager

References · 5

• 🔥 https://blog.nintechnet.com/insecure-deserialization-vulnerability-in-wordpress-newsletter-manager-plugin-unpatched · Exploit
• https://osv.dev/vulnerability/CVE-2020-36727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36727 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/dcfd8c4d-d48b-468d-a7d5-1ec05b068f79?source=cve · Note
• https://wpscan.com/vulnerability/b82124b1-e5e1-4f1e-9513-90474fd3f066 · Note