Multiple vulnerabilities in ActivityPub plugin for WordPress



Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2023-5057
CVE-2023-3707
CVE-2023-3706
CWE-ID CWE-79
CWE-639
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Vulnerable software
 ActivityPub
Web applications / Modules and components for CMS

Vendor Matthias Pfefferle

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Stored cross-site scripting

EUVDB-ID: #VU82204

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-5057

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ActivityPub: 0.0.1 - 0.17.0

CPE2.3 External links

https://wpscan.com/vulnerability/58a63507-f0fd-46f1-a80c-6b1c41dddcf5


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Authorization bypass through user-controlled key

EUVDB-ID: #VU82206

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-3707

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the affected plugin does not ensure that post contents to be displayed are public and belong to the plugin. A remote user can retrieve the content of arbitrary post via an IDOR vector

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ActivityPub: 0.0.1 - 0.17.0

CPE2.3 External links

https://wpscan.com/vulnerability/541bbe4c-3295-4073-901d-763556269f48


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Authorization bypass through user-controlled key

EUVDB-ID: #VU82205

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-3706

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the affected plugin does not ensure that post titles to be displayed are public and belong to the plugin. A remote user can retrieve the title of arbitrary post via an IDOR vector.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ActivityPub: 0.0.1 - 0.17.0

CPE2.3 External links

https://wpscan.com/vulnerability/daa4d93a-f8b1-4809-a18e-8ab63a05de5a


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###