CVE-2023-47530

2023-12-1823:15:08

CWE-89

[email protected]

web.nvd.nist.gov

cve-2023-47530

sql injection

wpvibes

404 error page

security vulnerability

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

0.001 Low

EPSS

Percentile

19.4%

JSON

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.

Affected configurations

Vulners

NVD

Node

wpvibesredirect_404_error_page_to_homepage_or_custom_page_with_logsRange≤1.8.7

VendorProductVersionCPE
wpvibesredirect_404_error_page_to_homepage_or_custom_page_with_logs*cpe:2.3:a:wpvibes:redirect_404_error_page_to_homepage_or_custom_page_with_logs:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wpvibes	redirect_404_error_page_to_homepage_or_custom_page_with_logs	*	cpe:2.3:a:wpvibes:redirect_404_error_page_to_homepage_or_custom_page_with_logs::::::::

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "redirect-404-error-page-to-homepage-or-custom-page",
    "product": "Redirect 404 Error Page to Homepage or Custom Page with Logs",
    "vendor": "WPVibes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.8.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.8.7",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/redirect-404-error-page-to-homepage-or-custom-page/wordpress-redirect-404-error-page-to-homepage-or-custom-page-with-logs-plugin-1-8-7-sql-injection-vulnerability?_s_id=cve