PT-2024-1575 · Unknown · Activitypub

Rafie Muhammad · Published 2024-01-05 · Updated 2024-06-13 · CVE-2023-52199

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ActivityPub versions 1.0.0 through 1.0.5

Description The issue is related to a Missing Authorization vulnerability. This vulnerability can be exploited by a remote attacker to perform unauthorized functions, modify, or delete arbitrary content.

Recommendations For ActivityPub versions 1.0.0 through 1.0.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-01136

CVE-2023-52199

Affected Products

Activitypub

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-52199 · Security Note
• https://bdu.fstec.ru/vul/2024-01136 · Security Note
• https://patchstack.com/database/vulnerability/activitypub/wordpress-activitypub-plugin-1-0-5-unauthenticated-broken-access-control-vulnerability?_s_id=cve · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/activitypub/activitypub-105-missing-authorization · Note
• https://wpscan.com/vulnerability/5fb58642-61ba-447c-80ac-68d3777486d7 · Note