CVE-2023-27433

2023-10-0414:15:10

CWE-352

Patchstack

web.nvd.nist.gov

cve-2023-27433

cross-site request forgery

csrf

yas global team

make paths relative plugin

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

24.0%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Make Paths Relative allows Cross Site Request Forgery.This issue affects Make Paths Relative: from n/a through 1.3.0.

Affected configurations

Nvd

Vulners

Node

yasglobalmake_paths_relativeRange≤1.3.0wordpress

VendorProductVersionCPE
yasglobalmake_paths_relative*cpe:2.3:a:yasglobal:make_paths_relative:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
yasglobal	make_paths_relative	*	cpe:2.3:a:yasglobal:make_paths_relative::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "make-paths-relative",
    "product": "Make Paths Relative",
    "vendor": "YAS Global Team",
    "versions": [
      {
        "changes": [
          {
            "at": "2.0.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.3.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/make-paths-relative/wordpress-make-paths-relative-plugin-1-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve