{"id":4789,"date":"2023-05-13T19:29:35","date_gmt":"2023-05-13T17:29:35","guid":{"rendered":"https:\/\/sajberinfo.com\/?p=4789"},"modified":"2023-05-14T10:29:51","modified_gmt":"2023-05-14T08:29:51","slug":"ugrozeno-milion-wordpress-stranica","status":"publish","type":"post","link":"https:\/\/sajberinfo.com\/en\/2023\/05\/13\/ugrozeno-milion-wordpress-stranica\/","title":{"rendered":"Ugro\u017eeno milion WordPress stranica"},"content":{"rendered":"

Sigurnosni istra\u017eiva\u010di su otkrili da je ugro\u017eeno milion WordPress<\/em> stranica koji upotrebljavaju Essential<\/em> dodatak za Elementor<\/em> WordPress<\/em>.<\/span><\/p>\n

\"Elementor

Ugro\u017eeno milion WordPress stranica; Dizajn: Sa\u0161a \u0110uri\u0107<\/em><\/p><\/div>\n

Ranjivost<\/strong><\/span><\/h2>\n

Sa preko milion instalacija, dodatak Essential<\/em> za Elementor<\/em> pro\u0161iruju osnovne mogu\u0107nosti\u00a0 Elementor<\/em> dodatka za WordPress<\/em>. Uo\u010dena ranjivost u ovom dodatku je ozna\u010dena CVE-2023-32243<\/em><\/a> (sa CVSS<\/em> ocjenom 9.8) i ozna\u010dena je kao kriti\u010dna ranjivost koja omogu\u0107ava neovla\u0161tenu zloupotrebu privilegija koja mo\u017ee napada\u010du omogu\u0107iti da preuzme bilo koji korisni\u010dki nalog. Smatra se da je ova ranjivost prisutna od verzije 5.4.0<\/em> ovog dodatka.<\/span><\/p>\n

 <\/p>\n

\u201cMoguc\u0301e je resetovati lozinku bilo kog korisnika sve dok znamo njegovo korisni\u010dko ime i tako mo\u017eemo resetovati lozinku administratora i prijaviti se na njihov nalog.\u201d<\/em><\/span><\/p>\n

\u00a0<\/em><\/span>– <\/em>Sigurnosni istra\u017eiva\u010d Rafie Muhammad<\/em><\/a> –<\/em><\/span><\/p>\n<\/blockquote>\n

 <\/p>\n

Ovo mo\u017ee biti ozbiljan problem, jer se ova ranjivost mo\u017ee iskoristiti za resetovanje lozinke administratorskog naloga, \u0161to zlonamjernim napada\u010dima mo\u017ee omogu\u0107iti potpunu kontrolu nad mre\u017enom lokacijom. Ranjivost je otkrivena 8. maja i autor dodatka je odmah upoznat sa njom, tako da je 11. maja objavljena verzija 5.7.2<\/em><\/a> koja ispravlja ovu ranjivost.<\/span><\/p>\n

 <\/p>\n

Otklanjanje ranjivosti<\/strong><\/span><\/h3>\n

Autor dodatka je, prema dostupnim informacijama, adekvatno izvr\u0161io ispravljanje ranjivosti dodaju\u0107i funkciju\u00a0 koja vr\u0161i provjeru i legitimnost klju\u010deva za resetovanje lozinke. Korisnicima se preporu\u010duje da \u0161to prije preuzmu a\u017euriranu verziju Essential<\/em> dodatka za Elementor<\/em> verziju 5.7.2<\/em>.<\/span><\/p>\n

Koliko je ovo ozbiljan problem govori i podatak kompanije Defiant<\/em> koja razvija sigurnosni dodatak Wordfence<\/em> za WordPress:<\/em><\/span><\/p>\n

\u00a0<\/em><\/span><\/p>\n

\u201cWordfence je blokirao 151 napad usmjeren na ovu ranjivost u posljednja 24 sata.\u201d<\/em><\/span><\/p>\n

\u00a0<\/em><\/span>– <\/em>Defiant<\/em><\/a><\/span> –<\/span> <\/em><\/p>\n<\/blockquote>","protected":false},"excerpt":{"rendered":"

Sigurnosni istra\u017eiva\u010di su otkrili da je ugro\u017eeno milion WordPress stranica koji upotrebljavaju Essential dodatak za Elementor WordPress. Ranjivost Sa preko milion instalacija, dodatak Essential za Elementor pro\u0161iruju osnovne mogu\u0107nosti\u00a0 Elementor dodatka za WordPress. Uo\u010dena...<\/p>","protected":false},"author":1,"featured_media":4792,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[325,367,259],"class_list":["post-4789","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hronike","tag-elementor","tag-essential","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/4789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/comments?post=4789"}],"version-history":[{"count":0,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/posts\/4789\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media\/4792"}],"wp:attachment":[{"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/media?parent=4789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/categories?post=4789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sajberinfo.com\/en\/wp-json\/wp\/v2\/tags?post=4789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}