Log Injection Vulnerability in SALESmanago Plugin for WordPress

CVE-2023-4939

What is CVE-2023-4939?

The SALESmanago plugin for WordPress, in versions up to 3.2.4, is susceptible to a Log Injection issue. This vulnerability arises from the use of a weak authentication token associated with the /wp-json/salesmanago/v1/callbackApiV3 API endpoint, which is derived from a SHA1 hash of the site URL and client ID. Unauthenticated attackers can exploit this weakness to inject arbitrary content into log files. The consequences may be severe, especially when combined with other vulnerabilities, potentially compromising system integrity and sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References