PT-2024-12904 · Unknown · Simple Urls

Rafshanzani Suhada · Published 2024-12-13 · Updated 2024-12-17 · CVE-2023-40678

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Simple URLs versions 1.17 and earlier

Description A Missing Authorization vulnerability in Simple URLs allows exploiting incorrectly configured access control security levels. This issue is related to broken access control, which can be exploited due to incorrectly configured access control security levels. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Simple URLs version 1.17 and earlier, update to the latest version to mitigate risks. As a temporary workaround, consider restricting access to vulnerable components until a patch is available. Ensure your site is secure by updating to the latest version.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-40678

Affected Products

Simple Urls

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-40678 · Security Note
• https://twitter.com/transilienceai/status/1868887184335360350 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/simple-urls/vulnerability/wordpress-simple-urls-plugin-117-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1867908542767731199 · Twitter Post
• https://twitter.com/transilienceai/status/1868525319478534232 · Twitter Post
• https://twitter.com/transilienceai/status/1868887194825310399 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/simple-urls/vulnerability/wordpress-simple-urls-plugin-117-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/transilienceai/status/1868525332338233429 · Twitter Post