CVE-2023-4242mediumCWE-287

CVE-2023-4242: falha de média gravidade em fullservices FULL – Cliente

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar FULL – Cliente

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.5%
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
fullservices · FULL – Cliente
CVEs relacionadas — fullservices FULL – Cliente

No mesmo produto, das mais perigosas para as menos.

CVE-2023-4243HIGHFULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin InstallationEPSS 0.9%CVE-2024-6447HIGHFULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan ParameterEPSS 0.5%CVE-2024-12023MEDIUMFULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2024-9211MEDIUMFULL – Cliente <= 3.1.22 - Reflected Cross-Site ScriptingEPSS 0.4%