PT-2023-29832 · Lavacode · Lavacode Lava Directory Manager

Emili Castells · Published 2023-10-26 · Updated 2023-10-30 · CVE-2023-46081

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lavacode Lava Directory Manager plugin versions <= 1.1.34

Description The issue is related to an Unauth. Stored Cross-Site Scripting (XSS) vulnerability. This allows for the storage of malicious scripts that can be executed by other users, potentially leading to unauthorized actions. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions <= 1.1.34, update to a version greater than 1.1.34 to resolve the issue. At the moment, there is no information about additional mitigation measures or workarounds for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46081

Affected Products

Lavacode Lava Directory Manager

References · 6

• https://osv.dev/vulnerability/CVE-2023-46081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46081 · Security Note
• https://twitter.com/VulmonFeeds/status/1717551086754554323 · Twitter Post
• https://t.me/cibsecurity/72947 · Telegram Post
• https://patchstack.com/database/vulnerability/lava-directory-manager/wordpress-lava-directory-manager-plugin-1-1-34-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/latest_high_impact_cve/52 · Telegram Post