2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Print Invoice & Delivery Notes for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"4.7.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tychesoftwares:print_invoice_\\&_delivery_notes_for_woocommerce:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"57D900AB-BC91-4C85-91AD-F0A836DC5960","versionEndExcluding":"4.7.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding."},{"lang":"es","value":"El complemento Print Invoice & Delivery Notes para WooCommerce WordPress anterior a 4.7.2 es vulnerable al XSS reflejado al hacer eco de un valor GET en una nota administrativa dentro de la página de pedidos de WooCommerce. Esto significa que esta vulnerabilidad puede ser aprovechada por usuarios con la capacidad edit_others_shop_orders. WooCommerce debe estar instalado y activo. Esta vulnerabilidad es causada por un urldecode() después de la limpieza con esc_url_raw(), lo que permite la doble codificación."}],"id":"CVE-2023-0479","lastModified":"2026-06-17T05:25:38.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-0479","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-01-16T20:41:34.591991Z","version":"2.0.3"}}]},"published":"2024-01-16T16:15:10.580","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|