CVE-2023-1430

MEDIUM

FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-1430 has a selected CVSS score of 6.5 (medium); EIP currently links 1 repository PoC.

Description

The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 28, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution

Browse techjewel / FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution

Default status: unaffected

CVE ListThrough 2.8.0.1affected

Proofs of concept

1

Repository PoCs

GitHubkarlemilnikka/CVE-2023-1430Repository PoCby karlemilnikka0Not analyzed4 files

38.1 KiB

GitHub
PoC details

References

5