Server-Side Request Forgery Vulnerability in Dropbox Folder Share Plugin
CVE-2023-3025

7.2HIGH

Key Information:

Vendor
Wordpress
Status
Dropbox Folder Share
Vendor
CVE Published:
16 September 2023

Summary

The Dropbox Folder Share plugin for WordPress is susceptible to a Server-Side Request Forgery vulnerability due to improper validation of the 'link' parameter. This issue affects versions up to and including 1.9.7, allowing unauthenticated attackers to send web requests to unauthorized locations by leveraging the web application. This flaw could be exploited to access or manipulate sensitive information from internal services.

Affected Version(s)

Dropbox Folder Share * <= 1.9.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/dropbox-folder...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Thomas
.