CVE-2023-6029

{"id": "CVE-2023-6029", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-01-15T16:15:12.230", "references": [{"url": "https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections."}, {"lang": "es", "value": "El complemento de WordPress de EazyDocs anterior a 2.3.6 no tiene autorizaci\u00f3n ni controles CSRF al manejar documentos y no garantiza que sean documentos del complemento, lo que permite a usuarios no autenticados eliminar publicaciones arbitrarias, as\u00ed como agregar y eliminar documentos/secciones."}], "lastModified": "2024-01-19T18:06:04.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:spider-themes:eazydocs:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "241F442D-2084-47E2-B4A4-3B8BCA0C4020", "versionEndExcluding": "2.3.6"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}