PT-2024-13209 · Litespeed Technologies · Litespeed Cache

Rafie Muhammad · Published 2024-04-16 · Updated 2024-04-17 · CVE-2023-45000

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache versions n/a through 5.7

Description The issue is related to a Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache. This vulnerability allows for remote attacks due to the lack of proper authorization.

Recommendations For LiteSpeed Cache versions n/a through 5.7, upgrade to a patched version as soon as possible to resolve the issue. Additionally, review the plugin's security settings to ensure they are properly configured.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-45000

Affected Products

Litespeed Cache

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-45000 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45000 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1780339382173458670 · Twitter Post
• https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-5-7-unauthenticated-broken-access-control-on-api-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1780495208645308660 · Twitter Post
• https://twitter.com/CVEnew/status/1780299654120276003 · Twitter Post
• https://twitter.com/oktsec/status/1780351167936991395 · Twitter Post