Lucene search

PatchstackCVELIST:CVE-2023-33923

HistoryMar 25, 2024 - 4:46 a.m.

CVE-2023-33923 Broken Access Control leading to Arbitrary Plugin Activation in multiple HashThemes themes

2024-03-2504:46:03

CWE-862

Patchstack

www.cve.org

cve-2023-33923

broken access control

hashthemes

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

Missing Authorization vulnerability in HashThemes Viral News, HashThemes Viral, HashThemes HashOne.This issue affects Viral News: from n/a through 1.4.5; Viral: from n/a through 1.8.0; HashOne: from n/a through 1.3.0.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "viral-news",
    "product": "Viral News",
    "vendor": "HashThemes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.4.6",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.4.5",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "viral",
    "product": "Viral",
    "vendor": "HashThemes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.8.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.8.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "hashone",
    "product": "HashOne",
    "vendor": "HashThemes",
    "versions": [
      {
        "changes": [
          {
            "at": "1.3.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.3.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/hashone/wordpress-hashone-theme-1-3-0-broken-access-control-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/viral-news/wordpress-viral-news-theme-1-4-5-authenticated-arbitrary-plugin-activation-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/viral/wordpress-viral-theme-1-8-0-broken-access-control-vulnerability?_s_id=cve

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVELIST:CVE-2023-33923