CVE-2023-6444

MEDIUMNuclei

Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-6444 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Seriously Simple Podcasting

Default status: unaffected

CVE ListBefore 3.0.0affected

seriously_simple_podcasting

Browse castos / seriously_simple_podcasting

Default status: unaffected

CVE ListBefore 3.0.0affected

Proofs of concept

1

Repository PoCs

GitHubWayne-Ker/CVE-2023-6444-POCRepository PoCby Wayne-Ker0Not analyzed2 files

2.0 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMSeriously Simple Podcasting < 3.0.0 - Information DisclosureCVSS 5.3

The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.

Impact

Unauthenticated attackers can send crafted requests to obtain podcast owner email addresses which typically reveal administrator email addresses, enabling targeted phishing attacks.

Remediation

Fixed in 3.0.0

Authorss4e-io
Template tagscvecve2023wordpresswp-pluginexposurewpseriously-simple-podcastingvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:seriously_simple_podcasting_plugin:seriously_simple_podcasting_plugin:2:*:*:*:*:*:*:*
https://wpscan.com/vulnerability/061c59d6-f4a0-4cd1-b945-5e92b9c2b4aa/ https://github.com/Wayne-Ker/CVE-2023-6444-POC/blob/main/cve-2023-6444.py https://nvd.nist.gov/vuln/detail/CVE-2023-6444

Source: ProjectDiscovery

References

2