CVE-2023-28667: Lead Generated WordPress Plugin, десериализация

Описание

Оригинално описание

The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.

Засегнати продукти

• n/a Lead Generated WordPress Plugin: <= 1.23

Вид слабост

• CWE-502 Десериализация на ненадеждни данни

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-28667
• https://nvd.nist.gov/vuln/detail/CVE-2023-28667
• https://www.tenable.com/security/research/tra-2023-7