How severe is CVE-2023-5982?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.4 out of 10.

What type of vulnerability is CVE-2023-5982?

This is classified as CWE-352, which is a common weakness in software security.

CVE-2023-5982 - MEDIUM Severity | CVSS 5.4

Vulnerability Description

The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.

Related Vulnerabilities

CVE-2013-2108

MEDIUM

CVSS:5.4(Medium)

WordPress WP Cleanfix Plugin 2.4.4 has CSRF

CWE-3522013

CVE-2015-5037

MEDIUM

CVSS:5.4(Medium)

Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to hijack the authentica...

CWE-3522015

CVE-2015-9425

MEDIUM

CVSS:5.4(Medium)

The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.

CWE-3522015

CVE-2016-3098

MEDIUM

CVSS:5.4(Medium)

Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.

CWE-3522016

CVE-2017-18485

MEDIUM

CVSS:5.4(Medium)

Cognitoys Dino devices allow profiles_add.html CSRF.

CWE-3522017

CVE-2018-0146

MEDIUM

CVSS:5.4(Medium)

A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. Th...

CWE-3522018