Vulnerability identifier: #VU92117

Vulnerability risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-2704

CWE-ID: CWE-306

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
BP Social Connect
Web applications / Modules and components for CMS

Vendor: VibeThemes

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to insufficient verification on the user being supplied during a Facebook login through the plugin. A remote unauthenticated attacker can bypass security restrictions on the target system and log in as any existing user on the site, such as an administrator.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

BP Social Connect: 1.0 - 1.5

---

External links
http://www.wordfence.com/threat-intel/vulnerabilities/id/44c96df2-530a-4ebe-b722-c606a7b135f9?source=cve
http://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L138
http://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L188
http://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2914042%40bp-social-connect%2Ftrunk&old=1904372%40bp-social-connect%2Ftrunk&sfp_email=&sfph_mail=#file6
http://lana.codes/lanavdb/1bd0dfd9-ffec-4d69-bc55-286751300cab/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.