CVE-2023-3202: MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update

Q: What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is CVE-2023-3202.

Q: What is the severity of CVE-2023-3202?

The severity of CVE-2023-3202 is medium with a severity score of 4.3.

Q: Which software is affected by CVE-2023-3202?

The MStore API plugin for WordPress version up to 3.9.6 is affected by CVE-2023-3202.

Q: What is the CWE ID of CVE-2023-3202?

The CWE ID of CVE-2023-3202 is 352.

Q: How can I fix CVE-2023-3202?

To fix CVE-2023-3202, update the MStore API plugin for WordPress to a version higher than 3.9.6.

Published Jul 12, 2023

Updated

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstoreupdatefirebaseserverkey function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected Software

1 affected component

InspireUI Mstore Api Wordpress<=3.9.6

Event History

Jul 12, 2023

CVE Published

via MITRE·04:38 AM

Data Sourced

via MITRE·04:38 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is CVE-2023-3202.

What is the severity of CVE-2023-3202?

The severity of CVE-2023-3202 is medium with a severity score of 4.3.

Which software is affected by CVE-2023-3202?