Lucene search

WPScanCVE-2023-5355

HistoryNov 06, 2023 - 9:15 p.m.

CVE-2023-5355

2023-11-0621:15:09

CWE-22

WPScan

web.nvd.nist.gov

cve-2023-5355

awesome support

wordpress plugin

file path

security vulnerability

nvd

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.

Affected configurations

Nvd

Vulners

Node

getawesomesupportawesome_supportRange<6.1.5wordpress

VendorProductVersionCPE
getawesomesupportawesome_support*cpe:2.3:a:getawesomesupport:awesome_support:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
getawesomesupport	awesome_support	*	cpe:2.3:a:getawesomesupport:awesome_support::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Awesome Support",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "6.1.5"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/d6f7faca-dacf-4455-a837-0404803d0f25

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

Related for CVE-2023-5355