Overview for rules released by Trustwave SpiderLabs in January for ModSecurity Commercial Rules package. The rules are available for versions 2.9.x and 3.x of ModSecurity.
ModSecurity Commercial Rules detect attacks or classes of attacks on web applications and their components as well as provide virtual patches for public vulnerabilities.
Release Summary
- WordPress Plugin Multiple Plugins from Wow-Company - Reflected XSS CVE-2023-2362
- WordPress Plugin Icegram Engage < 3.1.12 - Reflected XSS CVE-2023-2398
- WordPress Plugin Photo Gallery by Ays < 5.1.7 - Reflected XSS CVE-2023-2568
- WordPress Plugin WP Custom Cursors < 3.2 - Admin+ SQLi CVE-2023-2221
- WordPress Plugin Integration for Contact Form 7 and Zoho CRM, Bigin < 1.2.4 - Admin+ SQLi CVE-2023-2527
- WordPress Plugin Conditional Menus < 1.2.1 - Reflected XSS CVE-2023-2654
- WordPress Plugin SupportCandy < 3.1.7 - Subscriber+ SQLi CVE-2023-2719
- WordPress Plugin Super Socializer < 7.13.52 - Reflected XSS CVE-2023-2779
- WordPress Plugin WP Brutal AI < 2.0.0 - SQL Injection via CSRF CVE-2023-2601
- WordPress Plugin WP ERP < 1.12.4 - Admin+ SQL Injection CVE-2023-2744
- WordPress Plugin WP Brutal AI < 2.0.1 - Admin+ Reflected XSS CVE-2023-2605
- WordPress Plugin KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting CVE-2023-2624
- WordPress Plugin Editorial Calendar < 3.8.3 - Contributor+ Stored XSS CVE-2022-4115
- WordPress Plugin Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS CVE-2023-0588
- WordPress Plugin Responsive CSS EDITOR <= 1.0 - Admin+ SQLi CVE-2023-2482
- WordPress Plugin WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF CVE-2023-2842
- WordPress Plugin Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution CVE-2023-2877
- WordPress Plugin Post SMTP < 2.6.1 - Authenticated (Administrator+) SQL Injection
- WordPress Plugin Post SMTP < 2.8.7 - Admin+ SQL Injection CVE-2023-6620
- WordPress Plugin Post SMTP < 2.8.7 - Reflected Cross-Site Scripting CVE-2023-6621
- WordPress Plugin POST SMTP Mailer < 2.8.8 - Authorization Bypass via type connect-app API CVE-2023-6875
How to Update
All the rules released this month are available for download and can be configured using the ModSecurity Dashboard. The rules are associated with the default profile and enabled for all licensed servers. To verify the rules were successfully downloaded by ModSecurity, log in to the ModSecurity Dashboard and verify the server "Last seen" date, which indicates the last successful download for the specified server.
