CVE-2023-1430

Katalog CVE

CVSS 6.5 · Medium EPSS 0,80%

Kerentanan Use of a One-Way Hash without a Salt pada wpmanageninja fluentcrm. Skor CVSS 3.1 6.5 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.

Rincian

Terbit di NVD

9 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-759: Use of a One-Way Hash without a Salt

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/2899218/fluent-crm/tags/2.8.0/app/Hooks/Handlers/ExternalPages.ph... patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/de6da87e-8f7d-4120-8a1b-390ef7733d84?source=cve advisory pihak ketiga
• https://github.com/karlemilnikka/CVE-2023-1430
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2924787%40fluent-crm&new=2924...