CVE-2023-2287

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2287
The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:themeisle:orbitfox:*:*:*:*:*:wordpress:*:*
History

07 Nov 2023, 04:12

Type Values Removed Values Added
CWE CWE-918

05 Jun 2023, 14:55

Type Values Removed Values Added
References (MISC) https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb - (MISC) https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb - Exploit
First Time Themeisle
Themeisle orbitfox
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CPE cpe:2.3:a:themeisle:orbitfox:*:*:*:*:*:wordpress:*:*

30 May 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-30 08:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-2287

Mitre link : CVE-2023-2287

CVE.ORG link : CVE-2023-2287

JSON object : View

Products Affected

themeisle

  • orbitfox
CWE

No CWE.