formatting

http/cves/2023/CVE-2023-5089.yaml

@@ -1,44 +1,50 @@
 id: CVE-2023-5089
 
 info:
-  name: WordPress Defender Security Plugin - Hidden Login Bypass
+  name: Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
   author: jpg0mez
-  severity: low
+  severity: medium
   description: |
-    The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function,
+    The Defender Security WordPress plugin before 4.1.0 does not
-    allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
+    prevent redirects to the login page via the auth_redirect WordPress
-    -----IMPORTANT------
+    function, allowing an unauthenticated visitor to access the login page, even
-    Note: This PoC calls the auth_redirect function via GravityForms (gf_page). Most WordPress plugins that hide the login page are vulnerable
+    when the hide login page functionality of the plugin is enabled.
-    to this, so be sure to confirm the target is using WP-Defender.
+  remediation: Fixed in 4.1.0
-  remediation: |
-    Upgrade to the latest version to mitigate this vulnerability.
   reference:
     - https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms
     - https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d/
     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5089
-  tags: wordpress,cve,cve2023,bypass
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2023-5089
+    epss-score: 0.00046
+    epss-percentile: 0.13944
+    cpe: cpe:2.3:a:wpmudev:defender_security:*:*:*:*:*:wordpress:*:*
+  metadata:
+    vendor: wpmudev
+    product: defender_security
+    framework: wordpress
+  tags: cve,cve2023,wordpress,wpscan,defender,wp-plugin,redirect
 
 http:
   - method: GET
     path:
       - "{{BaseURL}}/?gf_page=randomstring"
-    cookie-reuse: true
     redirects: true
+
     matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
-          - "loginform"
+          - loginform
-          - "password"
+          - password
-          - "Powered by WordPress"
+          - Powered by WordPress
         condition: and
+
       - type: word
         words:
-          - "wp-login.php"
+          - wp-login.php
         part: header
         negative: true
-      - type: word
-        words:
-          - "wp-login.php"
-        part: body
-        negative: true