PT-2023-31937 · WordPress · Ari Stream Quiz – Wordpress Quizzes Builder

Rafie Muhammad · Published 2023-12-31 · Updated 2024-01-05 · CVE-2023-52182

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ARI Stream Quiz – WordPress Quizzes Builder versions 1.3.0 and earlier

Description The issue is related to the deserialization of untrusted data in ARI Stream Quiz – WordPress Quizzes Builder. This can potentially lead to security risks. No information is provided about the estimated number of affected devices or real-world incidents.

Recommendations For versions 1.3.0 and earlier, update to a version later than 1.3.0 to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable components until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-52182

Affected Products

Ari Stream Quiz – Wordpress Quizzes Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-52182 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52182 · Vendor Advisory
• https://t.me/cvenotify/66467 · Telegram Post
• https://twitter.com/CVEnew/status/1741402654428049504 · Twitter Post
• https://t.me/cvenotify/65838 · Telegram Post
• https://t.me/cibsecurity/74060 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1741424509477916908 · Twitter Post
• https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-plugin-1-3-0-php-object-injection-vulnerability?_s_id=cve · Note