CVE-2023-4796mediumCWE-200

CVE-2023-4796: falha de média gravidade em pluggabl Booster for WooCommerce – PDF…

Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.7%
The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
pluggabl · Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
CVEs relacionadas — pluggabl Booster for WooCommerce – PDF…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3957MEDIUMBooster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.9%CVE-2024-13342HIGHBooster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File UploadEPSS 0.7%CVE-2023-4945MEDIUMBooster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2023-5638MEDIUMBooster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-9170MEDIUMBooster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta ShortcodeEPSS 0.5%CVE-2024-9239MEDIUMBooster for WooCommerce <= 7.2.3 - Reflected Cross-Site ScriptingEPSS 0.4%