Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page.
References
| Link | Resource |
|---|---|
| https://jvn.jp/en/jp/JVN99657911/ | Third Party Advisory |
| https://wordpress.org/plugins/liquid-speech-balloon/#developers | Release Notes |
| https://jvn.jp/en/jp/JVN99657911/ | Third Party Advisory |
| https://wordpress.org/plugins/liquid-speech-balloon/#developers | Release Notes |
Configurations
History
21 Nov 2024, 07:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jvn.jp/en/jp/JVN99657911/ - Third Party Advisory | |
| References | () https://wordpress.org/plugins/liquid-speech-balloon/#developers - Release Notes |
17 May 2023, 12:54
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:lqd:liquid_speech_balloon:*:*:*:*:*:wordpress:*:* | |
| First Time |
Lqd
Lqd liquid Speech Balloon |
|
| CWE | CWE-352 | |
| References | (MISC) https://jvn.jp/en/jp/JVN99657911/ - Third Party Advisory | |
| References | (MISC) https://wordpress.org/plugins/liquid-speech-balloon/#developers - Release Notes |
10 May 2023, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-10 06:15
Updated : 2025-01-27 21:15
NVD link : CVE-2023-27889
Mitre link : CVE-2023-27889
CVE.ORG link : CVE-2023-27889
JSON object : View
Products Affected
lqd
- liquid_speech_balloon
CWE
CWE-352
Cross-Site Request Forgery (CSRF)