CVE-2023-6583

The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3007057/	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:codection:import_and_export_users_and_customers:*:*:*:*:*:wordpress:*:*

History

17 Jan 2024, 18:42

Type	Values Removed	Values Added
First Time		Codection import And Export Users And Customers Codection
CWE		CWE-22
CPE		cpe:2.3:a:codection:import_and_export_users_and_customers::::::wordpress::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=cve - Third Party Advisory
References	~~() https://plugins.trac.wordpress.org/changeset/3007057/ -~~	() https://plugins.trac.wordpress.org/changeset/3007057/ - Patch

11 Jan 2024, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-11 09:15

Updated : 2024-02-28 20:54

NVD link : CVE-2023-6583

Mitre link : CVE-2023-6583

CVE.ORG link : CVE-2023-6583

JSON object : View

Products Affected

codection

import_and_export_users_and_customers

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-6583", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}]}, "published": "2024-01-11T09:15:49.777", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3007057/", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information."}, {"lang": "es", "value": "El complemento Import and export users and customers para WordPress es vulnerable a Directory Traversal en todas las versiones hasta la 1.24.2 incluida a trav\u00e9s de la funcionalidad de importaci\u00f3n recurrente. Esto hace posible que atacantes autenticados, con acceso de administrador y superior, lean y eliminen el contenido de archivos arbitrarios en el servidor, incluido wp-config.php, que puede contener informaci\u00f3n confidencial."}], "lastModified": "2024-01-17T18:42:13.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:codection:import_and_export_users_and_customers:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "9D954D92-332A-48C2-B024-2DCDFEABD020", "versionEndIncluding": "1.24.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}