Log Injection Vulnerability in SALESmanago Plugin for WordPress

CVE-2023-4939

What is CVE-2023-4939?

The SALESmanago plugin for WordPress, in versions up to 3.2.4, is susceptible to a Log Injection issue. This vulnerability arises from the use of a weak authentication token associated with the /wp-json/salesmanago/v1/callbackApiV3 API endpoint, which is derived from a SHA1 hash of the site URL and client ID. Unauthenticated attackers can exploit this weakness to inject arbitrary content into log files. The consequences may be severe, especially when combined with other vulnerabilities, potentially compromising system integrity and sensitive data.

References