Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2023-0291
HistoryJun 09, 2023 - 6:15 a.m.

CVE-2023-0291

2023-06-0906:15:48
[email protected]
web.nvd.nist.gov
5
authorization bypass
missing capability check
ajax action
unauthenticated attackers
arbitrary media files
cve-2023-0291

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON

The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

Affected configurations

Nvd
Node
expresstechquiz_and_survey_masterRange≤8.0.8wordpress
VendorProductVersionCPE
expresstechquiz_and_survey_master*cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*

Related

prion 1
osv 1
cvelist 1
cve 1
zdt 2
packetstorm 2
wordfence 1
prion
prion
Authorization
2023-06-09 06:15:00
osv
osv
CVE-2023-0291
2023-06-09 06:15:48
cvelist
cvelist
CVE-2023-0291
2023-06-09 05:33:19
cve
cve
CVE-2023-0291
2023-06-09 06:15:48
zdt
zdt
WordPress Quiz And Survey Master 8.0.8 Media Deletion Vulnerability
2023-02-15 00:00:00
WordPress Quiz And Survey Master 8.0.8 Cross Site Request Forgery Vulnerability
2023-02-15 00:00:00
packetstorm
packetstorm
WordPress Quiz And Survey Master 8.0.8 Media Deletion
2023-02-15 00:00:00
WordPress Quiz And Survey Master 8.0.8 Cross Site Request Forgery
2023-02-15 00:00:00
wordfence
wordfence
Wordfence Intelligence CE Weekly Vulnerability Report (Feb 13, 2023 to Feb 19, 2023)
2023-02-23 16:30:44

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON
Related for NVD:CVE-2023-0291
prion1osv1cvelist1cve1zdt2packetstorm2wordfence1