PT-2023-28700 · WordPress · Vrm 360 3D Model Viewer

0Xp1P3 + 1 · Published 2023-12-18 · Updated 2023-12-21 · CVE-2023-4311

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vrm 360 3D Model Viewer WordPress plugin versions 1.2.1 and earlier

Description The issue arises from insufficient checks in a plugin shortcode, allowing for arbitrary file upload.

Recommendations For Vrm 360 3D Model Viewer WordPress plugin versions 1.2.1 and earlier, consider disabling the vulnerable shortcode until a patch is available to prevent arbitrary file uploads.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-4311

Affected Products

Vrm 360 3D Model Viewer

References · 4

• 🔥 https://wpscan.com/vulnerability/21950116-1a69-4848-9da0-e912096c0fce · Exploit
• https://osv.dev/vulnerability/CVE-2023-4311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4311 · Security Note
• https://twitter.com/CVEnew/status/1736842770835214806 · Twitter Post