CVE-2023-4025mediumCWE-862

CVE-2023-4025: falha de média gravidade em princeahmed Radio Player – Live Shoutcast…

Radio Player <= 2.0.73 - Missing Authorization to Player Update

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_player function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
princeahmed · Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player
CVEs relacionadas — princeahmed Radio Player – Live Shoutcast…

No mesmo produto, das mais perigosas para as menos.

CVE-2023-4024MEDIUMRadio Player <= 2.0.73 - Missing Authorization to Player DeletionEPSS 0.5%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2023-4027MEDIUMRadio Player <= 2.0.73 - Missing Authorization to Settings UpdateEPSS 0.4%CVE-2024-8267MEDIUMRadio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.3%CVE-2024-13362MEDIUMFreemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url ParameterEPSS 0.3%