ByteOS Network

NVD Vulnerability Details :

CVE-2023-0291

Modified

Source-security@wordfence.com

Published At-09 Jun, 2023 | 06:15

Updated At-07 Nov, 2023 | 04:00

The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Secondary	3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

CPE Matches

expresstech>>quiz_and_survey_master>>Versions up to 8.0.8(inclusive)

cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*

References

Hyperlink	Source	Resource
https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txt	security@wordfence.com	Not Applicable VDB Entry
https://plugins.trac.wordpress.org/changeset/2834471/quiz-master-next	security@wordfence.com	Patch
https://wordpress.org/plugins/quiz-master-next/	security@wordfence.com	Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/68110321-db1a-4634-98cd-0afd3ec933b8?source=cve	security@wordfence.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History