Lucene search

WPScanCVE-2023-5905

HistoryJan 15, 2024 - 4:15 p.m.

CVE-2023-5905

2024-01-1516:15:12

CWE-862

WPScan

web.nvd.nist.gov

cve

demomentsomtres

wordpress

export

authorization

security

vulnerability

nvd

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.

Affected configurations

Nvd

Vulners

Node

demomentsomtresexport_posts_with_imagesRange≤20220825wordpress

VendorProductVersionCPE
demomentsomtresexport_posts_with_images*cpe:2.3:a:demomentsomtres:export_posts_with_images:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
demomentsomtres	export_posts_with_images	*	cpe:2.3:a:demomentsomtres:export_posts_with_images::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "DeMomentSomTres WordPress Export Posts With Images",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "20220825"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/f94e91ef-1773-476c-9945-37e89ceefd3f

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

19.4%

JSON

Related for CVE-2023-5905