CVE-2023-6991 — HIGH (8.8) — White Hats Nepal

Q: How severe is CVE-2023-6991?

CVE-2023-6991 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2023-6991?

Check the references section above for vendor advisories and patch information. Affected products include: Surniaulula Jsm File Get Contents\(\) Shortcode.

Vulnerability Description

The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Surniaulula	Jsm File Get Contents\(\) Shortcode	< 2.7.1

Related Weaknesses (CWE)

CWE-918

References

https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bcExploitThird Party Advisory
https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bcExploitThird Party Advisory

FAQ

What is CVE-2023-6991?

CVE-2023-6991 is a vulnerability with a CVSS score of 8.8 (HIGH). The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and...

How severe is CVE-2023-6991?

CVE-2023-6991 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-6991?

Check the references section above for vendor advisories and patch information. Affected products include: Surniaulula Jsm File Get Contents\(\) Shortcode.