CVE-2023-25458

2023-05-0420:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-25458

authorization

stored xss

gmo internet group

inc.

typesquare webfonts

conoha plugin

nvd

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

0.0005 Low

EPSS

Percentile

17.5%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GMO Internet Group, Inc. TypeSquare Webfonts for ConoHa plugin <= 2.0.3 versions.

Affected configurations

Vulners

NVD

Node

gmo_internet_group\,_inc.typesquare_webfonts_for_conohaRange≤2.0.3

CPENameOperatorVersion
gmo:typesquare_webfonts_for_conohagmo typesquare webfonts for conohalt2.0.4

CPE	Name	Operator	Version
gmo:typesquare_webfonts_for_conoha	gmo typesquare webfonts for conoha	lt	2.0.4

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "ts-webfonts-for-conoha",
    "product": "TypeSquare Webfonts for ConoHa",
    "vendor": "GMO Internet Group, Inc.",
    "versions": [
      {
        "changes": [
          {
            "at": "2.0.4",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.0.3",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/ts-webfonts-for-conoha/wordpress-typesquare-webfonts-for-conoha-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve