Lucene search

JpcertCVE-2024-25572

HistoryApr 11, 2024 - 3:15 a.m.

CVE-2024-25572

2024-04-1103:15:09

jpcert

web.nvd.nist.gov

cross-site request forgery

ninja forms

vulnerability

unintended operations

website administrator

malicious page

logging in

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

15.5%

JSON

Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.

Affected configurations

Vulners

Node

saturday_driveninja_formsRange<3.4.31

VendorProductVersionCPE
saturday_driveninja_forms*cpe:2.3:a:saturday_drive:ninja_forms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
saturday_drive	ninja_forms	*	cpe:2.3:a:saturday_drive:ninja_forms::::::::

CNA Affected

[
  {
    "vendor": "Saturday Drive",
    "product": "Ninja Forms",
    "versions": [
      {
        "version": "prior to 3.4.31",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN50361500/

ninjaforms.com/

wordpress.org/plugins/ninja-forms/

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

15.5%

JSON

Related for CVE-2024-25572