Add incorrect CVE note

2023-03-17 10:06:27 -04:00 · 2023-03-17 10:06:27 -04:00 · 463fe078c2
parent edf213bdea
commit 463fe078c2
1 changed files with 2 additions and 0 deletions
--- a/cves/2023/CVE-2023-23492.yaml
+++ b/cves/2023/CVE-2023-23492.yaml
@ -6,6 +6,8 @@ info:
  severity: medium
  description: |
    Login with Phone Number, versions < 1.4.2, is affected by an reflected XSS vulnerability in the login-with-phonenumber.php' file in the 'lwp_forgot_password()' function.
+
+    Note that CVE-2023-23492 incorrectly describes and scores this as SQL injection vulnerability.
  reference:
    - https://wordpress.org/plugins/login-with-phone-number/
    - https://www.tenable.com/security/research/tra-2023-3