CVE-2023-2716mediumCWE-862

CVE-2023-2716: falha de média gravidade em trainingbusinesspros Groundhogg — CRM…

Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Groundhogg — CRM, Newsletters, and Marketing Automation

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.5%
The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload a file to the contact, and then lists all the other uploaded files related to the contact.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
trainingbusinesspros · Groundhogg — CRM, Newsletters, and Marketing Automation
CVEs relacionadas — trainingbusinesspros Groundhogg — CRM…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-4206HIGHWordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File DeletionEPSS 1.6%CVE-2025-0394HIGHGroundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload FunctionEPSS 1.2%CVE-2026-109221HIGHGroundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field MappingEPSS 0.8%CVE-2026-18387MEDIUMGroundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' ParameterEPSS 0.7%CVE-2026-13333MEDIUMGroundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' ParameterEPSS 0.6%CVE-2023-2715MEDIUMGroundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket CreationEPSS 0.6%