PT-2023-27245 · Unknown · Advanced Custom Fields Pro

Ryotaro Imamura + 1 · Published 2023-08-21 · Updated 2023-08-25 · CVE-2023-40068

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields versions 6.1.0 through 6.1.7 Advanced Custom Fields Pro versions 6.1.0 through 6.1.7

Description A cross-site scripting vulnerability allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with administrative privilege. This issue potentially affects approximately 1 million sites.

Recommendations For Advanced Custom Fields versions 6.1.0 through 6.1.7, update to a version later than 6.1.7 to resolve the issue. For Advanced Custom Fields Pro versions 6.1.0 through 6.1.7, update to a version later than 6.1.7 to resolve the issue. As a temporary workaround, consider restricting access to administrative privileges until a patch is applied.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-40068

Affected Products

Advanced Custom Fields Pro

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2023-40068 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40068 · Vendor Advisory
• https://advancedcustomfields.com/blog/acf-6-1-8 · Vendor Advisory
• https://t.me/pentestingnews/38706 · Telegram Post
• https://twitter.com/Dinosn/status/1693854716000633114 · Twitter Post
• https://twitter.com/fofabot/status/1693897359217099078 · Twitter Post
• https://twitter.com/Komodosec/status/1693903734030647302 · Twitter Post
• https://advancedcustomfields.com · Note
• https://twitter.com/HunterMapping/status/1693971279680790676 · Twitter Post
• https://t.me/cibsecurity/68875 · Telegram Post
• https://t.me/cvenotify/56978 · Telegram Post
• https://wordpress.org/plugins/advanced-custom-fields · Note
• https://jvn.jp/en/jp/JVN98946408 · Note