The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/e8a4b6ab-47f8-495d-a22c-dcf914dfb58c | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/e8a4b6ab-47f8-495d-a22c-dcf914dfb58c | Exploit Third Party Advisory |
Configurations
History
30 Jan 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-639 |
Information
Published : 2023-05-02 08:15
Updated : 2025-01-30 15:15
NVD link : CVE-2023-1125
Mitre link : CVE-2023-1125
CVE.ORG link : CVE-2023-1125
JSON object : View
Products Affected
wpruby
- ruby_help_desk
CWE
CWE-639
Authorization Bypass Through User-Controlled Key