TablePress Plugin 켜짐 WordPress Table Import Import data 크로스 사이트 스크립팅 🚫 [오탐]
알림
⚠️ 이 문제는 오탐(false-positive)으로 보입니다. 언급된 소스를 확인하시고, 이 항목의 사용을 지양해 주시기 바랍니다.
제품
유형
이름
타임라인
2022. 11. 01. 🔍2022. 11. 01. 🔍
2022. 11. 01. 🔍
2022. 11. 30. 🔍
출처
권고: drive.google.com오탐: 네
논쟁 중: 🔍
CVE: CVE-2022-3788 (🔍)
GCVE (CVE): GCVE-0-2022-3788
GCVE (VulDB): GCVE-100-212610
scip Labs: https://www.scip.ch/en/?labs.20161013
항목
만들어진: 2022. 11. 01. PM 02:24업데이트됨: 2022. 11. 30. AM 11:16
변경 사항: 2022. 11. 01. PM 02:24 (41), 2022. 11. 03. PM 01:58 (2), 2022. 11. 03. PM 02:02 (10), 2022. 11. 30. AM 11:09 (1), 2022. 11. 30. AM 11:16 (1)
완벽한: 🔍
커미터: TobiasBg
Cache ID: 216::103
제출
중복
If you want to get best quality of vulnerability data, you may have to visit VulDB.
This is Tobias, the author and developer of the mentioned TablePress plugin for WordPress.
I have reviewed this submission and come to the conclusion that it is invalid and false.
From the provided screenshots, it’s clear that the reporter is logged in as an Administrator to the WordPress site. As such, he has the "unfiltered_html" capability, which means that he is allowed to add, edit, and import arbitrary HTML and JavaScript content in TablePress and WordPress. This is by design in WordPress.
Unprivileged users, like Authors, do not have this capability and the JavaScript code will be stripped. All this follows the WordPress guidelines, see https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-some-users-allowed-to-post-unfiltered-html
I therefore ask you to remove this false report, as well as the CVE entry that has been opened for this. Thank you.
If there are any questions, please let me know!
Best wishes,
TobiasBg
Author and Developer of TablePress
https://tablepress.org/
as you know users with multiple role can be add shortcode for add tablepress in posts
for example author user can import tablepress payload like html value then insert shortcode of that in posts
https://drive.google.com/file/d/1SlJU2ditOt569hSA_TDws93bj5XWPbA-/view?usp=sharing
https://drive.google.com/file/d/1MARrvkstR5hX6Zn-9YdojjOMgJ6vuRjN/view?usp=sharing
Best Regard