Lucene search

[email protected]CVE-2023-25781

HistoryMay 26, 2023 - 12:15 p.m.

CVE-2023-25781

2023-05-2612:15:15

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-25781

authentication

admin+

stored xss

cross-site scripting

sebastian krysmanski

upload file type settings plugin

nvd

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:M/C:P/I:P/A:N

0.0004 Low

EPSS

Percentile

13.2%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sebastian Krysmanski Upload File Type Settings plugin <= 1.1 versions.

CPENameOperatorVersion
upload_file_type_settings_plugin_project:upload_file_type_settings_pluginupload file type settings plugin project upload file type settings pluginle1.1
upload_file_type_settings_plugin_project:upload_file_type_settings_pluginupload file type settings plugin project upload file type settings plugineq1.1

CPE	Name	Operator	Version
upload_file_type_settings_plugin_project:upload_file_type_settings_plugin	upload file type settings plugin project upload file type settings plugin	le	1.1
upload_file_type_settings_plugin_project:upload_file_type_settings_plugin	upload file type settings plugin project upload file type settings plugin	eq	1.1

References

patchstack.com/database/vulnerability/upload-file-type-settings-plugin/wordpress-upload-file-type-settings-plugin-plugin-1-1-cross-site-scripting-xss?_s_id=cve

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:M/C:P/I:P/A:N

0.0004 Low

EPSS

Percentile

13.2%

JSON

Related for CVE-2023-25781

prion1 wpvulndb1 wordfence1