CVE-2023-0994 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis
An attacker can access sensitive information in the RosarioSIS WordPress plugin without authorization, requiring an upgrade to secure the data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0994?
CVE-2023-0994 is a high-severity vulnerability in francoisjacquet/rosariosis, published on 24 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
Weakness: CWE-200
Which versions are affected by CVE-2023-0994?
2 open source packages ship an affected version, including francoisjacquet/rosariosis. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
francoisjacquet/rosariosis Packagist | All versions | 10.8.2 |
francoisjacquet/rosariosis Packagist | All versions | 10.8.2 |
Products include Rosariosis Rosariosis.
How do I fix CVE-2023-0994?
Upgrade francoisjacquet/rosariosis to 10.8.2 or later.
Is CVE-2023-0994 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0994 exists.
Other vulnerabilities in francoisjacquet/rosariosis
- CVE-2021-44567 SQL injection in francoisjacquet/rosariosis
- CVE-2021-44427 SQL Injection in rosariosis
- CVE-2022-2036 Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
- CVE-2022-2067 SQL Injection in francoisjacquet/rosariosis
- CVE-2022-1997 Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Sources
Also known as GHSA-prjg-28jg-m3p5.