PT-2023-6977 · WordPress · Jeecg P3 Biz Chat

Published 2023-06-07 · Updated 2025-01-07 · CVE-2023-33510

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jeecg P3 Biz Chat version 1.0.5

Description The issue is related to the disclosure of information in the error data area of the Jeecg P3 Biz Chat plugin for WordPress content management systems. Exploitation of this issue may allow a remote attacker to read arbitrary files through specific parameters.

Recommendations For Jeecg P3 Biz Chat version 1.0.5, consider restricting access to specific parameters that allow remote attackers to read arbitrary files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Path traversal

Weakness Enumeration

CWE-668

CWE-22

Related Identifiers

BDU:2023-07996

CVE-2023-33510

GHSA-V3V9-3JF4-5PXX

Affected Products

Jeecg P3 Biz Chat

References · 9

• 🔥 https://carl1l.github.io/2023/05/08/jeecg-p3-biz-chat-1-0-5-jar-has-arbitrary-file-read-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2023-33510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33510 · Security Note
• https://bdu.fstec.ru/vul/2023-07996 · Security Note
• https://osv.dev/vulnerability/GHSA-v3v9-3jf4-5pxx · Vendor Advisory
• https://twitter.com/rst_cloud/status/1837592540574351841 · Twitter Post
• https://jeecg.com · Note
• https://t.me/cvenotify/51969 · Telegram Post
• https://broadcom.com/support/security-center/attacksignatures/detail?asid=34225 · Note