6.1

CVE-2023-7202

Exploit

Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email Sending

Fatal Error Notify <= 1.5.2 - Missing Authorization to Test Error Email Sending

The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF
Mögliche Gegenmaßnahme
Fatal Error Notify: Update to version 1.5.3, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Verygoodplugins ≫ Fatal Error Notify SwPlatformwordpress Version < 1.5.3
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Fatal Error Notify
Version *-1.5.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.133
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/
Third Party Advisory
Exploit
https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/50499cd6-0e27-494a-892c-5ca827d4433b
Third Party Advisory