CVE-2023-34173

2023-08-3015:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-34173

authenticated

stored cross-site scripting

alexander semikashev

yandex metrica counter plugin

version 1.4.3

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

23.9%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alexander Semikashev Yandex Metrica Counter plugin <= 1.4.3 versions.

Affected configurations

Nvd

Node

yandex_metrica_counter_projectyandex_metric_counterRange≤1.4.3wordpress

VendorProductVersionCPE
yandex_metrica_counter_projectyandex_metric_counter*cpe:2.3:a:yandex_metrica_counter_project:yandex_metric_counter:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
yandex_metrica_counter_project	yandex_metric_counter	*	cpe:2.3:a:yandex_metrica_counter_project:yandex_metric_counter::::::wordpress::*

References

patchstack.com/database/vulnerability/counter-yandex-metrica/wordpress-yandex-metrica-counter-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve