7.3

CVE-2023-40004

Multiple ServMask Plugins <= (Various Versions) - Missing Authorization to Access Token Update

Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue affects All-in-One WP Migration Box Extension: from n/a through 1.53; All-in-One WP Migration OneDrive Extension: from n/a through 1.66; All-in-One WP Migration Dropbox Extension: from n/a through 3.75; All-in-One WP Migration Google Drive Extension: from n/a through 2.79.
Mögliche Gegenmaßnahme
All-in-One WP Migration Box Extension: Update to version 1.54, or a newer patched version
All-in-One WP Migration Dropbox Extension: Update to version 3.76, or a newer patched version
All-in-One WP Migration Google Drive Extension: Update to version 2.80, or a newer patched version
All-in-One WP Migration OneDrive Extension: Update to version 1.67, or a newer patched version
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt All-in-One WP Migration Box Extension
Version *-1.53
SystemWordPress Plugin
≫
Produkt All-in-One WP Migration Dropbox Extension
Version *-3.75
SystemWordPress Plugin
≫
Produkt All-in-One WP Migration Google Drive Extension
Version *-2.79
SystemWordPress Plugin
≫
Produkt All-in-One WP Migration OneDrive Extension
Version *-1.66
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellerservmask
≫
Produkt all-in-one_wp_migration
Default Statusunknown
Version 1.54
Status affected
Version 2.80
Status affected
Version 1.67
Status affected
Version 3.76
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.09% 0.904
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
audit@patchstack.com 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.