CVE-2023-5644

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

T

he WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

References

Link	Resource
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e	Exploit Third Party Advisory
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 08:42

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e - Exploit, Third Party Advisory

Information

Published : 2023-12-26 19:15

Updated : 2024-11-21 08:42

NVD link : CVE-2023-5644

Mitre link : CVE-2023-5644

CVE.ORG link : CVE-2023-5644

JSON object : View

Products Affected

wp_mail_log

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-5644", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2023-12-26T19:15:07.843", "references": [{"url": "https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users."}, {"lang": "es", "value": "El complemento WP Mail Log WordPress anterior a 1.1.3 no autoriza correctamente sus endpoint de API REST, lo que permite a los usuarios con el rol de Colaborador ver y eliminar datos a los que solo deber\u00edan tener acceso los usuarios administradores."}], "lastModified": "2024-11-21T08:42:11.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "0DB6599D-1AF5-4662-B350-8389E2D4988E", "versionEndExcluding": "1.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}