CVE-2023-47188
Published: 02 January 2025
Summary
CVE-2023-47188 is a medium-severity Missing Authorization (CWE-862) vulnerability in Presstigers Simple Job Board. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-47188 is a missing authorization vulnerability (CWE-862) in the PressTigers Simple Job Board WordPress plugin (simple-job-board). It allows exploitation of incorrectly configured access control security levels and affects all versions from n/a through 2.10.5. The CVSS v3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.
An unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation enables the attacker to bypass authorization checks due to incorrectly configured access control, potentially leading to unauthorized modifications consistent with the low integrity impact.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simple-job-board/vulnerability/wordpress-simple-job-board-plugin-2-10-5-broken-access-control-vulnerability?_s_id=cve) documents this broken access control vulnerability in Simple Job Board version 2.10.5.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51321
Vulnerability details
Missing Authorization vulnerability in PressTigers Simple Job Board simple-job-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through <= 2.10.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization vulnerability in public-facing WordPress plugin directly enables exploitation of internet-facing application for unauthorized modifications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly addressing the missing authorization checks bypassed in the Simple Job Board plugin.
Requires timely identification, reporting, and correction of system flaws, mitigating this specific broken access control vulnerability through patching affected plugin versions.
Mandates secure configuration settings for system components, countering the exploitation of incorrectly configured access control security levels in the vulnerable plugin.