CVE-2023-5559

{"id": "CVE-2023-5559", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-11-27T17:15:08.927", "references": [{"url": "https://wpscan.com/vulnerability/eba46f7d-e4db-400c-8032-015f21087bbf", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service."}, {"lang": "es", "value": "El complemento 10Web Booster de WordPress anterior al 24.2.18 no valida el nombre de opci\u00f3n dado a algunas acciones AJAX, lo que permite a usuarios no autenticados eliminar opciones arbitrarias de la base de datos, lo que lleva a la denegaci\u00f3n de servicio."}], "lastModified": "2023-11-30T20:19:30.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:10web:10web_booster:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "3DAA777F-5807-4D4F-8A86-E904B2A70665", "versionEndExcluding": "2.24.18"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}