PT-2024-12057 · WordPress · Js Help Desk

Abdi Pranata · Published 2024-05-17 · Updated 2024-05-17 · CVE-2023-25444

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JS Help Desk – Best Help Desk & Support Plugin versions n/a through 2.7.7

Description The issue allows the upload of malicious files, potentially leading to security risks. This is due to an Unrestricted Upload of File with Dangerous Type vulnerability in the JS Help Desk plugin.

Recommendations For versions n/a through 2.7.7, update to a version later than 2.7.7 to resolve the issue. As a temporary workaround, consider restricting file uploads to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-25444

Affected Products

Js Help Desk

References · 6

• https://osv.dev/vulnerability/CVE-2023-25444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25444 · Security Note
• https://twitter.com/CVEnew/status/1791391013107609879 · Twitter Post
• https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-best-help-desk-support-plugin-plugin-2-7-7-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1791378573166621067 · Twitter Post
• https://t.me/cvenotify/80194 · Telegram Post