diff --git a/CVE-2023/CVE-2023-34xx/CVE-2023-3452.json b/CVE-2023/CVE-2023-34xx/CVE-2023-3452.json new file mode 100644 index 00000000000..3a7fd60ce75 --- /dev/null +++ b/CVE-2023/CVE-2023-34xx/CVE-2023-3452.json @@ -0,0 +1,63 @@ +{ + "id": "CVE-2023-3452", + "sourceIdentifier": "security@wordfence.com", + "published": "2023-08-12T03:15:09.330", + "lastModified": "2023-08-12T03:15:09.330", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-98" + } + ] + } + ], + "references": [ + { + "url": "https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/tree.php?rev=2841358#L5", + "source": "security@wordfence.com" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/2951888/canto/trunk/includes/lib/tree.php", + "source": "security@wordfence.com" + }, + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=cve", + "source": "security@wordfence.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index 4406fb2e487..c1047b2bd27 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-08-12T02:00:28.950024+00:00 +2023-08-12T04:00:33.340393+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-08-12T01:15:45.177000+00:00 +2023-08-12T03:15:09.330000+00:00 ``` ### Last Data Feed Release @@ -29,21 +29,20 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -222503 +222504 ``` ### CVEs added in the last Commit -Recently added CVEs: `0` +Recently added CVEs: `1` +* [CVE-2023-3452](CVE-2023/CVE-2023-34xx/CVE-2023-3452.json) (`2023-08-12T03:15:09.330`) ### CVEs modified in the last Commit -Recently modified CVEs: `2` +Recently modified CVEs: `0` -* [CVE-2022-40982](CVE-2022/CVE-2022-409xx/CVE-2022-40982.json) (`2023-08-12T01:15:45.177`) -* [CVE-2023-24329](CVE-2023/CVE-2023-243xx/CVE-2023-24329.json) (`2023-08-12T00:15:49.533`) ## Download and Usage