PT-2023-20582 · WordPress · Kivicare

Erwan Lr · Published 2023-06-27 · Updated 2023-06-30 · CVE-2023-2628

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KiviCare WordPress plugin versions prior to 3.2.1

Description The issue concerns the lack of CSRF checks in various AJAX actions, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. This includes deleting arbitrary appointments, medical records, and creating or updating various user accounts, such as patients and doctors.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-2628

Affected Products

Kivicare

References · 3

• 🔥 https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2628 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2628 · Vendor Advisory