CVE-2023-3025
Last modified
CVE-2023-3025 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hynotech | Dropbox Folder Share | <= 1.9.7 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-3025?
How severe is CVE-2023-3025?
How do I fix CVE-2023-3025?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-3024Forcing the Bluetooth LE stack to segment 'prepare write res…6.5
- CVE-2023-30242NS-ASG v6.3 was discovered to contain a SQL injection vulner…9.8
- CVE-2023-30243Beijing Netcon NS-ASG Application Security Gateway v6.3 is v…7.5
- CVE-2023-30245SQL injection vulnerability found in Judging Management Syst…9.8
- CVE-2023-30246SQL injection vulnerability found in Judging Management Syst…9.8
- CVE-2023-30247File Upload vulnerability found in Oretnom23 Storage Unit Re…9.8
- CVE-2023-30253Dolibarr before 17.0.1 allows remote code execution by an au…8.8
- CVE-2023-30256Cross Site Scripting vulnerability found in Webkil QloApps v…6.1
- CVE-2023-30257A buffer overflow in the component /proc/ftxxxx-debug of Fii…7.8
- CVE-2023-30258Command Injection vulnerability in MagnusSolution magnusbill…9.8
- CVE-2023-30259A Buffer Overflow vulnerability in importshp plugin in Libre…5.5
- CVE-2023-3026Cross-site Scripting (XSS) - Stored in GitHub repository jgr…6.1
Are you affected by CVE-2023-3025?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST