6.5

CVE-2023-1330

Exploit

Redirection < 1.1.4 - Redirect Creation via CSRF

Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirect' function

The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.
Mögliche Gegenmaßnahme
Redirection: Update to version 1.1.4, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Inisev ≫ Redirection SwPlatformwordpress Version < 1.1.4
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Redirection
Version *-1.1.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.26
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA-ADP 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://wpscan.com/vulnerability/de4cff6d-0030-40e6-8221-fef56e12b4de
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/9a70e291-1bc9-44ad-91a2-cf0624bb8d88
Third Party Advisory