CVE-2023-0085mediumCWE-693

CVE-2023-0085: fallo de gravedad media en roxnor MetForm – Contact Form, Survey, Quiz, &…

Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.7%
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
roxnor · MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
CVEs relacionadas — roxnor MetForm – Contact Form, Survey, Quiz, &…

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-0084HIGHMetform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 28.6%CVE-2022-1442HIGHMetform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information DisclosureEPSS 8.8%CVE-2023-0714HIGHMetform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File UploadEPSS 1.0%CVE-2023-0688MEDIUMMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcodeEPSS 0.7%CVE-2023-0721HIGHMetform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV InjectionEPSS 0.7%CVE-2023-0693MEDIUMMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcodeEPSS 0.7%