Lucene search

WPScanCVE-2023-4819

HistoryOct 16, 2023 - 8:15 p.m.

CVE-2023-4819

2023-10-1620:15:16

WPScan

web.nvd.nist.gov

cve-2023-4819

shared files

wordpress

plugin

vulnerability

security

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.8%

JSON

The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.

Affected configurations

Nvd

Vulners

Node

tammersoftshared_filesRange<1.7.6wordpress

VendorProductVersionCPE
tammersoftshared_files*cpe:2.3:a:tammersoft:shared_files:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
tammersoft	shared_files	*	cpe:2.3:a:tammersoft:shared_files::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Shared Files",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.7.6"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/4423b023-cf4a-46cb-b314-7a09ac08b29a

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.8%

JSON

Related for CVE-2023-4819