CVE-2023-52206

2024-01-0820:15:45

CWE-502

[email protected]

web.nvd.nist.gov

cve

2023

52206

deserialization

untrusted data

live composer

page builder

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.7%

JSON

Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.

Affected configurations

Vulners

NVD

Node

live_composer_teampage_builder\Match_live_composer

CPENameOperatorVersion
blueastral:page_builder\:_live_composerblueastral page builder: live composerle1.5.25

CPE	Name	Operator	Version
blueastral:page_builder\:_live_composer	blueastral page builder: live composer	le	1.5.25

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "live-composer-page-builder",
    "product": "Page Builder: Live Composer",
    "vendor": "Live Composer Team",
    "versions": [
      {
        "lessThanOrEqual": "1.5.25",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-25-php-object-injection-vulnerability?_s_id=cve