CVE-2023-0291 Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion
Unauthenticated attackers can delete arbitrary media files due to a missing capability check in the Quiz And Survey Master WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0291?
CVE-2023-0291 is a high-severity missing authorization vulnerability in expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
Weakness: CWE-862
Which versions are affected by CVE-2023-0291?
It affects 1 product.
Products include Expresstech Quiz and Survey Master.
How do I fix CVE-2023-0291?
No fix has been published for CVE-2023-0291 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-0291 being exploited?
There is no known exploitation of CVE-2023-0291 in the wild and no public exploit code.
Other vulnerabilities in expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Sources
Also known as GHSA-qfx5-pmrr-ggvv.