6.5

CVE-2023-2623

Exploit

KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure

KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
Mögliche Gegenmaßnahme
KiviCare – Clinic & Patient Management System (EHR): Update to version 3.2.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Iqonic ≫ Kivicare SwPlatformwordpress Version < 3.2.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt KiviCare – Clinic & Patient Management System (EHR)
Version 3.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.75% 0.502
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/85cc39b1-416f-4d23-84c1-fdcbffb0dda0
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/39404341-8a27-4770-b6a6-d33e899b6bd8
Third Party Advisory