CVE-2023-49772

2023-12-2016:15:09

CWE-502

[email protected]

web.nvd.nist.gov

cve-2023-49772

deserialization

untrusted data

phpbits creative studio

genesis simple love

nvd

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.1%

JSON

Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0.

Affected configurations

Vulners

NVD

Node

phpbits_creative_studiogenesis_simple_loveRange≤2.0

CPENameOperatorVersion
phpbits:genesis_simple_lovephpbits genesis simple lovele2.0

CPE	Name	Operator	Version
phpbits:genesis_simple_love	phpbits genesis simple love	le	2.0

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "genesis-simple-love",
    "product": "Genesis Simple Love",
    "vendor": "Phpbits Creative Studio",
    "versions": [
      {
        "lessThanOrEqual": "2.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/genesis-simple-love/wordpress-genesis-simple-love-plugin-2-0-unauthenticated-php-object-injection-vulnerability?_s_id=cve