CVE-2023-2326 in Gravity Forms Google Sheet Connector Plugin

Résumé

par MITRE • 27/06/2023

The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Réserver: 27/04/2023
• Divulgation: 27/06/2023
• Modérer: accepté
• Entrée: VDB-230851
• CPE: prêt
• CWE: CWE-352 (confirmé)
• CVSS: 6.5 (NVD)
• EPSS: 0.00307
• KEV: non
• Activités: très faible
• Secteur: Hostingprovider

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-2326
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-2326
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-2326/