Lucene search

GoogleOSV:CVE-2023-0584

HistoryJun 03, 2023 - 2:15 a.m.

CVE-2023-0584

2023-06-0302:15:09

Google

osv.dev

cve-2023-0584

vulnerability

wordpress

vk blocks plugin

improper authorization

rest

update_options

contributor-level permissions

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.6%

JSON

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST ‘update_options’ function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the ‘vk_font_awesome_version’ option to an arbitrary value.

CPENameOperatorVersion
vk-blockseq1.48.0.1
vk-blockseq1.29.1.0
vk-blockseq1.45.0.1
vk-blockseq1.27.7.2
vk-blockseq1.0.15
vk-blockseq1.3.5
vk-blockseq1.27.5
vk-blockseq0.6.0
vk-blockseq1.11.4
vk-blockseq1.16.1

Name	Operator	Version
vk-blocks	eq	1.48.0.1
vk-blocks	eq	1.29.1.0
vk-blocks	eq	1.45.0.1
vk-blocks	eq	1.27.7.2
vk-blocks	eq	1.0.15
vk-blocks	eq	1.3.5
vk-blocks	eq	1.27.5
vk-blocks	eq	0.6.0
vk-blocks	eq	1.11.4
vk-blocks	eq	1.16.1

Rows per page:

1-10 of 2711

References

plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/font-awesome/class-vk-blocks-font-awesome-api.php

www.wordfence.com/threat-intel/vulnerabilities/id/b90b7f6c-df7f-48a5-b283-cf5facbd71e5?source=cve

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.6%

JSON

Related for OSV:CVE-2023-0584