Lucene search

[email protected]NVD:CVE-2023-0423

HistoryApr 10, 2023 - 2:15 p.m.

CVE-2023-0423

2023-04-1014:15:08

[email protected]

web.nvd.nist.gov

wordpress

amazon s3

plugin

reflected cross-site scripting

high privilege users

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

21.6%

JSON

The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected configurations

NVD

Node

wordpress_amazon_s3_projectwordpress_amazon_s3Range<1.6wordpress

References

wpscan.com/vulnerability/73d588d7-26ae-42e2-8282-aa02bcb109b6