7.5

CVE-2023-34000

Exploit

WooCommerce Stripe Payment Gateway <= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure

Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.
Mögliche Gegenmaßnahme
WooCommerce Stripe Payment Gateway: Update to one of the following versions, or a newer patched version: 5.5.1, 5.6.3, 5.7.1, 5.8.2, 5.9.1, 6.0.1, 6.1.1, 6.2.1, 6.3.1, 6.4.4, 6.5.2, 6.6.1, 6.7.1, 6.8.1, 6.9.1, 7.0.3, 7.1.1, 7.2.1, 7.3.1, 7.4.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WooCommerce Stripe Payment Gateway
Version * - 5.5.0
Version [5.5.0, 5.5.1)
Version [5.6.0, 5.6.3)
Version [5.7.0, 5.7.1)
Version [5.8.0, 5.8.2)
Version [5.9.0, 5.9.1)
Version [6.0.0, 6.0.1)
Version [6.1.0, 6.1.1)
Version [6.2.0, 6.2.1)
Version [6.3.0, 6.3.1)
Version [6.4.0, 6.4.4)
Version [6.5.0, 6.5.2)
Version [6.6.0, 6.6.1)
Version [6.7.0, 6.7.1)
Version [6.8.0, 6.8.1)
Version [6.9.0, 6.9.1)
Version [7.0.0, 7.0.3)
Version [7.1.0, 7.1.1)
Version [7.2.0, 7.2.1)
Version [7.3.0, 7.3.1)
Version 7.4.0
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Woocommerce ≫ Stripe Payment Gateway SwPlatformwordpress Version < 7.4.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.635
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
audit@patchstack.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.