CVE-2023-7089

CVSS 3.1 Score 5.4 of 10 (medium)

Details

Published Jan 29, 2024
Updated: Feb 3, 2024
CWE ID 79

Summary

CVE-2023-7089 is a vulnerability found in the Easy SVG Allow WordPress plugin version 1.0. It allows users with roles as low as Author to upload malicious SVG files containing XSS payloads, as the plugin fails to sanitize uploaded SVG files. This vulnerability has a base severity rating of MEDIUM, with a base score of 5.4 according to NIST's National Vulnerability Database (NVD). The exploitability score is 2.3 out of 10, indicating a relatively low level of difficulty for attackers to exploit this vulnerability. The impact score is 2.7, suggesting a moderate level of damage that can be caused by this vulnerability. The attack vector is through the network, and both the integrity and confidentiality impacts are assessed as low. The availability impact is none, meaning it does not affect the availability of the system. Remediation for this vulnerability involves updating the Easy SVG Allow plugin to a version that includes proper sanitization measures for uploaded SVG files.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-7089 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options