PT-2024-13177 · Berocket · Berocket Brands For Woocommerce

Thiennv · Published 2024-12-13 · Updated 2024-12-17 · CVE-2023-44149

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions BeRocket Brands for WooCommerce versions 3.8.2.2 and earlier

Description The issue affects the BeRocket Brands for WooCommerce plugin, allowing exploitation of incorrectly configured access control security levels due to a missing authorization vulnerability. This vulnerability enables broken access control, which can be exploited by attackers.

Recommendations For versions 3.8.2.2 and earlier, update the plugin to the latest version to safeguard the WordPress site and remediate the vulnerability. As a temporary workaround, consider restricting access to sensitive areas of the site until the update is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-44149

Affected Products

Berocket Brands For Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-44149 · Security Note
• https://twitter.com/transilienceai/status/1868887557108347050 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/brands-for-woocommerce/vulnerability/wordpress-brands-for-woocommerce-plugin-3-8-2-2-broken-access-control-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/brands-for-woocommerce/vulnerability/wordpress-brands-for-woocommerce-plugin-3-8-2-2-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/transilienceai/status/1868887548228944080 · Twitter Post
• https://twitter.com/CVEnew/status/1867908510228345053 · Twitter Post