Lucene search

[email protected]CVE-2023-31230

HistoryNov 13, 2023 - 6:15 p.m.

CVE-2023-31230

2023-11-1318:15:07

CWE-352

[email protected]

web.nvd.nist.gov

cve

2023

31230

cross-site request forgery

csrf

vulnerability

haoqisir

baidu tongji

generator

stored xss

nvd

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

6.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in Haoqisir Baidu Tongji generator allows Stored XSS.This issue affects Baidu Tongji generator: from n/a through 1.0.2.

Affected configurations

Vulners

NVD

Node

haoqisirbaidu_tongji_generatorRange≤1.0.2

CPENameOperatorVersion
baidu-tongji-generator_project:baidu-tongji-generatorbaidu-tongji-generator project baidu-tongji-generatorle1.0.2

CPE	Name	Operator	Version
baidu-tongji-generator_project:baidu-tongji-generator	baidu-tongji-generator project baidu-tongji-generator	le	1.0.2

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "baidu-tongji-generator",
    "product": "Baidu Tongji generator",
    "vendor": "Haoqisir",
    "versions": [
      {
        "lessThanOrEqual": "1.0.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/baidu-tongji-generator/wordpress-baidu-tongji-generator-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve