CVE-2023-23897
Published: 10 July 2023
Summary
CVE-2023-23897 is a medium-severity CSRF (CWE-352) vulnerability in Ozette Simple Mobile Url Redirect. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2023-23897 is a Cross-Site Request Forgery (CSRF) flaw, tracked as CWE-352, that affects the Simple Mobile URL Redirect plugin for WordPress in versions up to and including 1.7.2 from Ozette Plugins. It carries a CVSS 3.1 score of 4.3 reflecting network attack vector, low complexity, no required attacker privileges, required user interaction, and limited integrity impact without confidentiality or availability effects.
An unauthenticated attacker can exploit the issue by inducing a logged-in user to perform unintended actions through a crafted request, resulting in limited unauthorized changes to plugin settings such as URL redirects on the target site.
Public advisories published via Patchstack document the vulnerability and reference the affected plugin versions. The associated EPSS score stands at 0.5727 with an identical recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27980
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin <= 1.7.2 versions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.