CVE-2023-2627

Published Jun 27, 2023

Last updated a year ago

CVSS medium 4.3

Overview

Description: The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:iqonic:kivicare:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "06298436-44E9-45D2-AA83-BDBD3F3D0B87",
            "versionEndExcluding": "3.2.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References