2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Upload Media By URL","vendor":"Unknown","versions":[{"lessThan":"1.0.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:notetoservices:upload_media_by_url:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"88BAE1F4-FF92-416A-886D-65CA4E6799CF","versionEndExcluding":"1.0.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf."},{"lang":"es","value":"El plugin Upload Media By URL de WordPress anterior a la versión 1.0.8 no dispone de comprobación CSRF al subir archivos, lo que podría permitir a los atacantes hacer que los administradores que han iniciado sesión suban archivos (incluyendo HTML que contenga código JS para usuarios con la capacidad unfiltered_html) en su nombre."}],"id":"CVE-2023-3720","lastModified":"2026-06-17T06:14:42.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-3720","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-04-23T13:29:22.573551Z","version":"2.0.3"}}]},"published":"2023-08-30T15:15:09.410","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/16375a7f-0a9f-4961-8510-d047ffbf3954"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified"}
|