Log in Request a demo

CMS And Developer Tool Vulnerability Archive.

Entries 14Range March 2022 to March 2024

This page holds short security alerts about content management systems, WordPress plugins, e-commerce platforms and developer tools. It covers 14 items from March 2022 to March 2024. Each entry keeps its original title, publish date and text, newest first and grouped by quarter. Earlier addresses of these entries now lead to the matching entry here.

Jump to: 2024 Q1 | 2023 Q1 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1

All 14 entries

2024 Q1

Over 3,300 WordPress Sites Infected With Malicious Code

Published:

Hackers have recently exploited a vulnerability in outdated versions of the Popup Builder plugin to breach WordPress sites, infecting over 3,300 websites with malicious code. The flaw leveraged in the attacks is tracked as CVE-2023-6000, a cross-site scripting (XSS) vulnerability impacting Popup Builder versions 4.2.3 and older, which was initially disclosed in November 2023. 

According to reports, the attacks infect the Custom JavaScript or Custom CSS sections of the WordPress admin interface, and the malicious code is stored within the ‘wp_postmeta’ database table. The primary function of the injected code is to act as event handlers for various Popup Builder plugin events, such as ‘sgpb-ShouldOpen’, ‘sgpb-ShouldClose’, ‘sgpb-WillOpen’, ‘sgpbDidOpen’, ‘sgpbWillClose’, and ‘sgpb-DidClose.’ The attackers achieve malicious goals by redirecting visitors of infected sites to malicious destinations such as phishing pages and malware-dropping sites. The attacks originated from the domains “ttincoming.traveltraffic[.]cc” and “host.cloudsonicwave[.]com,” so blocking these two is recommended. 

WordPress site owners who are using the Popup Builder plugin must upgrade to the latest version, currently 4.2.7, which addresses CVE-2023-6000 and other security problems.

2023 Q1

Critical Vulnerability Alert In Atlassian Jira Service Management Server And Data Center

Published:

A critical security vulnerability has been detected in the Jira Service Management Server and Data Center solutions developed by Atlassian.

The vulnerability, coded as CVE-2023-22501, is caused by a faulty authentication control. The threat actor can exploit this vulnerability by using a specially prepared request to impersonate another user and gain access to a Jira Service Management session. The vulnerability affects the following versions:

  • 3.0
  • 3.1
  • 3.2
  • 4.0
  • 4.1
  • 5.0
Atlassian solved the vulnerability for Jira Service Management Server and Data Center

The vulnerability is resolved in versions 5.3.3, 5.4.2, 5.5.1, 5.6.0, and later. It is recommended that users of vulnerable versions upgrade promptly to a version that resolves the vulnerability.

Critical SQLi Alarm In CakePHP

Published:

A critical security vulnerability has been detected in the CakePHP Framework, which is designed to develop web applications using the PHP programming language.

The vulnerability, identified as CVE-2023-22727, allows remote attackers to perform SQL injection attacks on affected installations. The vulnerability is caused by insufficient cleaning of user-provided inputs.

The vulnerability has been fixed in versions 4.2.12, 4.3.11, and 4.4.10 of CakePHP, and users of vulnerable versions are advised to upgrade immediately. If upgrading is not possible, users can consider using the Pagination library of CakePHP to address the issue.

2022 Q4

Reflected XSS Alarm In ProfileGrid WordPress Plugin

Published:

A security vulnerability has been detected, allowing threat actors to perform Reflected XSS attacks in the ProfileGrid WordPress plugin, which offers features such as creating and managing user groups on WordPress websites. A Reflected XSS attack is carried out by injecting malicious scripts directly into an HTTP request by threat actors and executing them in the target user’s browser.

The vulnerability, tracked as CVE-2022-3578, is caused by the ProfileGrid WordPress plugin insufficiently clearing parameters sent to the page in versions before 5.1.1. As a result, a remote threat actor can direct users to open a malicious link, and they can execute arbitrary HTML code and script in the user’s browser in the context of the vulnerable website.

In order not to be the target of attacks that can be carried out using the security vulnerability in question, it is recommended to immediately upgrade the vulnerable ProfileGrid versions to the current versions (5.1.1) that fix the vulnerability.

WordPress reCAPTCHA Plugin Has An XSS Vulnerability

Published:

A vulnerability has been identified in the WordPress reCAPTCHA plugin, which protects WordPress website forms from spam/robot logins, that could allow threat actors to perform XSS (Cross-Site Scripting) attacks on affected installations.

The security vulnerability with code CVE-2022-3831 affects the “unfiltered_html” component and is caused by insufficient cleaning of user-supplied data. Exploiting the vulnerability requires administrative privileges.

The vulnerability, assessed as medium critical, affects all versions of WordPress reCAPTCHA 1.6 and earlier. The plugin has been removed from the WordPress market since November 2, 2022, and no current version fixes the vulnerability. In this context, it is recommended that users using the plugin in WordPress installations immediately disable or remove it to avoid being affected by the vulnerability.

2022 Q3

0-Day Vulnerability Detected In WPGateway Plugin

Published:

A critical 0-day vulnerability actively exploited by threat actors has been identified in the WPGateway plugin, which provides cloud service to WordPress users with installation, backup, and cloning capabilities.

The vulnerability, identified by WordFence security researchers and tracked with code CVE-2022-3180, allows an unauthenticated threat actor to add an administrator account to websites running WPGateway. As a result, threat actors with administrator privileges take full control of the site.

Using the vulnerability, more than 4.6 million attack attempts targeting more than 280,000 WordPress sites were detected and successfully blocked in the last month. The WordFence team has reported the vulnerability to WPGateway developers and has published a firewall rule for Wordfence Care/Wordfence Response customers. The most common observed security breach indicator for exploiting the vulnerability is the administrator account created with the “rangex” username. It was observed that the WPGateway plugin, last reviewed on September 9, is still vulnerable to vulnerability.

There is no update yet that fixes the vulnerability. In this context, in order not to be the target of attacks that can be carried out using vulnerabilities, it is recommended to follow the updates to be published regularly and to apply them immediately if they are published, to remove the installed WPGateway plugins until the update is released, and to check whether there are suspicious administrator users in the WordPress control panel.

0-Day Vulnerabilities In PrestaShop Makes E-Commerce Sites Vulnerable

Published:

Multiple critical 0-day security vulnerabilities that threat actors use to inject malicious code into e-commerce sites have been detected in the PrestaShop E-Commerce platform. The combined use of these 0-day security vulnerabilities causes threat actors to rexecute emote code execution (RCE) on affected web servers and capture their customers’ payment information.

The attack requires the platform to be vulnerable to SQL injection exploits. In the analysis performed, the attack starts with the threat actors sending malicious GET and POST requests to the endpoint open to SQL injection. Then, threat actors gain full control via the PHP file created at the platform’s root directory and inject a fake payment form on the prepayment page. In this way, the credit card information entered in the fake form by the store customers is captured.

PrestaShop officials stated that threat actors might be using MySQL Smarty cache storage features as part of the attack vector. Therefore, it is recommended to disable this feature as a mitigation measure.

SQL injection vulnerabilities affect PrestaShop versions 1.6.0.10 or higher. 1.7.8.2 and higher versions are not affected by the security vulnerability in default configurations. PrestaShop 1.7.8.7 was released to harden MySQL Smarty cache storage against code injection attacks. Web application administrators using vulnerable PrestaShop versions must immediately apply the updates that fix the vulnerabilities.

Multiple Critical Vulnerabilities Detected In Drupal CMS

Published:

Multiple security vulnerabilities, including critical ones, detected in the Drupal open-source content management system (CMS) have been fixed with updates released by Drupal officials.

The “critical” security vulnerability, as tracked CVE-2022-25277, affects Drupal CMS 9.3 and 9.4. The vulnerability found in Drupal Core can cause arbitrary PHP code execution on Apache web servers by loading specially crafted files. However, Drupal officials stated that this vulnerability only affects Apache web servers in specific configurations. Three other security vulnerabilities, considered less critical, allow performed cross-site scripting (XSS) attacks, disclosure of information, or bypassing of access restrictions.

These security vulnerabilities were fixed with Drupal CMS versions 9.4.3, 9.3.19, and 7.91. In order not to be the target of attacks using vulnerabilities, Drupal CMS users are advised to consider the recommendations published by CISA and immediately apply the published updates to the vulnerable versions.

WPBakery Page Builder Plugin’s Vulnerability Affects 1.6 Million WordPress Sites

Published:

The WordPress plugin, which allows editing and customizing WordPress pages without writing any code, is vulnerable to a vulnerability that could allow file uploads without authentication. Threat actors hacking campaigns are targeting approximately 1.6 million WordPress sites through this vulnerable plugin.

The critical vulnerability, tracked as CVE-2021-24284, allows an unauthenticated threat actor to inject malicious Javascript code into sites using any version of the plugin, resulting in a complete site takeover. Additionally, a trojan malware called NDSW is deployed that will redirect visitors to phishing and harmful advertising pages by injecting malicious code into legitimate Javascript files.

Due to the low probability of getting an update, it is recommended that the plugin be removed from use immediately, and alternatives should be found.

In addition, even if the plugin is not used, it is recommended that the IP addresses detected in the attack campaign be blocked from the security devices in use.

GitLab Releases Security Updates Fixing Critical Vulnerabilities

Published:

GitLab has released fixes and updates that fix critical vulnerabilities as part of the June security updates.

Some of the security vulnerabilities that have been fixed with the released updates and rated as critical, high, and medium are as follows;

  • Vulnerability tracked as CVE-2022-2185 (critical) exists due to incorrect input validation in Project Imports. As a result, a remote privileged user can import a maliciously crafted project, causing remote code execution on the vulnerable system.
  • The XSS vulnerability tracked as CVE-2022-2235 (high) is due to insufficient sanitization of user-supplied data in ZenTao integration. As a result, a remote threat actor can direct targets to open a specially crafted link and run arbitrary HTML and script code in the user’s browser in the context of the vulnerable website.
  • The security vulnerability tracked as CVE-2022-2229 (high) is caused by incorrect authorization. A remote threat actor can extract the value of an unprotected variable whose name it knows in public or private projects of which it is a member.

These vulnerabilities affected all GitLab CE/EE versions between 13.7.0 and 15.1.0 (inclusive) and were fixed in the released versions 15.1.1, 15.0.4, and 14.10.5. Users using vulnerable GitLab versions are advised to apply the released updates immediately.

Multiple Critical Vulnerabilities Detected In Jenkins

Published:

Multiple vulnerabilities have been detected in Jenkins – an open-source software developed with Java to automate the Continuous Integration process – allowing threat actors to perform XSS and CSRF attacks. Jenkins continually develops and tests software projects, making it easy for developers to integrate changes into the project.

Details of the vulnerabilities rated as critical are given below;

  • The vulnerability, tracked as CVE-2022-34784, is a cross-site scripting (XSS) vulnerability that affects the build-metrics plugin used by Jenkins and can be exploited by threat actors with build/update permissions.
  • CVE-2022-34787 is a cross-site scripting (XSS) vulnerability found in the Project Inheritance plugin used by Jenkins.
  • CVE-2022-34788 is a cross-site scripting (XSS) execution vulnerability found in the Matrix Reloaded plugin used by Jenkins.
  • CVE-2022-34790 is a cross-site scripting (XSS) vulnerability found in the eXtreme Feedback Panel plugin used by Jenkins.
  • The vulnerability tracked as CVE-2022-34792 is found in the Recipe plugin used by Jenkins and allows threat actors to perform cross-site request forgery (CSRF) and XXE (XML External Entity) injection attacks on the affected system.
  • The vulnerability tracked as CVE-2022-34791 resides in the Email Parameter plugin used by Jenkins and allows threat actors to perform cross-site scripting (XSS) attacks on affected installations.
  • CVE-2022-34783 is a cross-site scripting (XSS) vulnerability found in the Plot plugin used by Jenkins.
  • CVE-2022-34777 is a stored cross-site scripting (XSS) vulnerability found in the GitLab plugin used by Jenkins.
  • CVE-2022-34786 is a cross-site scripting (XSS) vulnerability found in the Rich Text Publisher plugin used by Jenkins.
  • CVE-2022-34778 is a cross-site scripting (XSS) vulnerability found in the TestNG Results plugin used by Jenkins.
  • CVE-2022-34795 is a stored cross-site scripting (XSS) vulnerability found in the Deployment Dashboard plugin used by Jenkins.

An update that fixes the security vulnerabilities detected in these Jenkins plugins has not been released yet. Successful exploitation of vulnerabilities can allow remote threat actors to obtain sensitive information, change the web page’s appearance, and carry out phishing attacks. In this context, it is recommended to follow the updates that fix the vulnerabilities and apply them immediately if they are published.

2022 Q2

Critical Authentication Bypass Security Vulnerability Detected In Atlassian Jira

Published:

Jira and Jira Service Management products developed by Atlassian have been identified to be affected by an authentication bypass vulnerability that exists in Jira Seraph, the web application security framework. In Seraph, Jira, and Confluence, it is a security and authentication framework used to process all login and logout requests.

The vulnerability, tracked with code CVE-2022-0540, allows a remote threat actor to bypass authentication by sending a specially crafted HTTP request to vulnerable endpoints.

The vulnerability, rated as critical, affects Jira Core Server, Software Data Center, Software Server, Service Management Server, and Management Data Center solutions. The versions of the affected solutions are as follows:

  • Jira Core Server, Software Server, and Software Data Center before 8.13.18, 8.14.x, 8.15.x, 8.16.x, 8.17.x, 8.18.x, 8.19.x, 8.20.x before 8.20.6 and 8.21.x versions are affected.
  • Jira Service Management Server versions earlier than 4.13.18 and Management Data Center, 4.14.x, 4.15.x, 4.16.x, 4.17.x, 4.18.x, 4.19.x, 4.20.x and earlier than 4.20.6 Versions 4.21.x are affected.

It is known that security vulnerability does not affect versions of Jira and Jira Service Management Cloud. Atlassian releases security updates for affected versions. Users who use vulnerable versions are advised to immediately upgrade to the current releases to not be the target of attacks that can be carried out using this vulnerability.

The Critical Vulnerability In Elementor WordPress Plugin Affects Thousands Of Websites

Published:

A critical remote code execution vulnerability has been detected in Elementor, the leading website-building platform for WordPress, that could affect nearly 500,000 websites.

The exploitation of the vulnerability requires authentication, but it is a serious threat that anyone entering the vulnerable website, including regular subscribers, can take advantage of the vulnerability. A threat actor who creates a regular user account on an affected website can change the name and theme of the affected site to make it look completely different.

It is foreseen that an unauthenticated user may exploit the critical vulnerability in the Elementor plugin in the continuing process, too. This RCE vulnerability has been fixed in the published version of 3.6.3. To avoid being affected by attacks that can be carried out using this vulnerability, website administrators are advised to apply the latest update available for the WordPress plugin or remove the plugin entirely from the website.

2022 Q1

A Security Vulnerability Has Been Detected In GitLab

Published:

It has detected a security vulnerability in GitLab, an open-source software development platform that allows a remote threat actor to obtain sensitive information about users such as first name, last name, email, and password. Data breaches using this vulnerability enable threat actors to create a new username list (Combolist) based on GitLab installations and perform Brute Force attacks through this list.

The vulnerability tracked by code CVE-2021-4191 exists due to insufficient authentication checking when processing specific GitLab GraphQL API queries. As a result, a remote threat actor can exploit the vulnerability to gain unauthorized access to sensitive information in the system.

The vulnerability affects all GitLab Community Edition and Enterprise Editions 13.0.0 – 14.8.1 but was fixed in the last released version. In addition, another critical vulnerability tracked as CVE-2022-0735 is fixed with the released updates. Users using vulnerable GitLab versions are advised to apply the released updates immediately.

Know What Is Exposed. Before Attackers Do.

Book a demo of the platform.

  • 4.7Gartner Peer Insights
  • 24hEarly warning time
  • 190+Countries covered

What you see in the demo

  1. Your exposureAssets and services seen from the outside, starting from your own domain.
  2. Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
  3. From alert to actionHow findings reach your team and what to do next.