PT-2023-25111 · WordPress · Web Push Notifications

Theodoros Malachias · Published 2023-11-13 · Updated 2023-11-17 · CVE-2023-35041

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webpushr Web Push Notifications plugin versions <= 4.34.0

Description The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that can lead to Local File Inclusion (LFI). This means an attacker could potentially trick a user into performing unintended actions on the web application, which in turn could allow the inclusion of local files, potentially revealing sensitive information.

Recommendations For Webpushr Web Push Notifications plugin versions <= 4.34.0, update to a version higher than 4.34.0 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-35041

Affected Products

Web Push Notifications

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-35041 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35041 · Vendor Advisory
• https://patchstack.com/database/vulnerability/webpushr-web-push-notifications/wordpress-web-push-notifications-webpushr-plugin-4-34-0-csrf-leading-to-lfi-vulnerability?_s_id=cve · Note