Lucene search

[email protected]CVE-2023-2159

HistoryJun 09, 2023 - 6:16 a.m.

CVE-2023-2159

2023-06-0906:16:04

[email protected]

web.nvd.nist.gov

wordpress

plugin

cmp

cve-2023-2159

maintenance mode bypass

vulnerability

security

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.1 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

26.5%

JSON

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin’s provided feature.

CPENameOperatorVersion
niteothemes:cmpniteothemes cmplt4.1.8
niteothemes:cmpniteothemes cmpeq3.9.3
niteothemes:cmpniteothemes cmpeq3.9.0
niteothemes:cmpniteothemes cmpeq3.0.2
niteothemes:cmpniteothemes cmpeq2.2.3
niteothemes:cmpniteothemes cmpeq3.8.5
niteothemes:cmpniteothemes cmpeq3.1
niteothemes:cmpniteothemes cmpeq4.1
niteothemes:cmpniteothemes cmpeq2.8.4
niteothemes:cmpniteothemes cmpeq2.8.9

CPE	Name	Operator	Version
niteothemes:cmp	niteothemes cmp	lt	4.1.8
niteothemes:cmp	niteothemes cmp	eq	3.9.3
niteothemes:cmp	niteothemes cmp	eq	3.9.0
niteothemes:cmp	niteothemes cmp	eq	3.0.2
niteothemes:cmp	niteothemes cmp	eq	2.2.3
niteothemes:cmp	niteothemes cmp	eq	3.8.5
niteothemes:cmp	niteothemes cmp	eq	3.1
niteothemes:cmp	niteothemes cmp	eq	4.1
niteothemes:cmp	niteothemes cmp	eq	2.8.4
niteothemes:cmp	niteothemes cmp	eq	2.8.9

Rows per page:

1-10 of 1711

References

plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.6/niteo-cmp.php#L808

plugins.trac.wordpress.org/changeset/2900571/cmp-coming-soon-maintenance/tags/4.1.8/cmp-advanced.php?old=2873620&old_path=cmp-coming-soon-maintenance%2Ftags%2F4.1.7%2Fcmp-advanced.php

www.wordfence.com/threat-intel/vulnerabilities/id/af955f69-b18c-446e-b05e-6a57a5f16dfa?source=cve

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.1 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

26.5%

JSON

Related for CVE-2023-2159

cvelist1 wpvulndb1 openvas1 prion1 wordfence1