PT-2024-13822 · Unknown · Rednao Smart Forms

Abdi Pranata · Published 2024-12-09 · Updated 2024-12-14 · CVE-2023-49856

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RedNao Smart Forms versions 2.6.84 and earlier

Description The issue is related to missing authorization in RedNao Smart Forms, allowing exploitation of incorrectly configured access control security levels.

Recommendations For RedNao Smart Forms versions 2.6.84 and earlier, update to a version that includes the necessary authorization checks to prevent exploitation of access control security levels. As a temporary workaround, consider reviewing and correcting the configuration of access control security levels in RedNao Smart Forms to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-49856

Affected Products

Rednao Smart Forms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-49856 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49856 · Vendor Advisory
• https://patchstack.com/database/Wordpress/Plugin/smart-forms/vulnerability/wordpress-smart-forms-plugin-2-6-84-authenticated-arbitrary-options-change-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1867811831257141489 · Twitter Post
• https://twitter.com/CVEnew/status/1866107151997132884 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/smart-forms/vulnerability/wordpress-smart-forms-plugin-2-6-84-authenticated-arbitrary-options-change-vulnerability?_s_id=cve · Note