PT-2023-32088 · WordPress · Icegram Express

Marco Wotschka · Published 2023-10-19 · Updated 2023-10-26 · CVE-2023-5414

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Icegram Express plugin for WordPress versions up to, and including, 5.6.23

Description The issue allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information, including those belonging to other sites, for example in shared hosting environments. This is achieved via the show es logs function.

Recommendations For versions up to, and including, 5.6.23, consider disabling the show es logs function until a patch is available to prevent potential exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-5414

Affected Products

Icegram Express

References · 6

• https://osv.dev/vulnerability/CVE-2023-5414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5414 · Security Note
• https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/classes/class-email-subscribers-logs.php?rev=2919465#L28 · Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977318%40email-subscribers%2Ftrunk&old=2972043%40email-subscribers%2Ftrunk&sfp_email=&sfph_mail=#file4 · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/417186ba-36ef-4d06-bbcd-e85eb9219689?source=cve · Note
• https://twitter.com/CVEnew/status/1715259860831420691 · Twitter Post