Lucene search

PatchstackCVE-2024-30535

HistoryMar 31, 2024 - 7:15 p.m.

CVE-2024-30535

2024-03-3119:15:46

CWE-89

Patchstack

web.nvd.nist.gov

cve-2024-30535

sql injection

whitestudio easy form builder

easy form builder

version 3.7.4.

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

AI Score

9.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WhiteStudio Easy Form Builder.This issue affects Easy Form Builder: from n/a through 3.7.4.

Affected configurations

Vulners

Node

whitestudioeasy_form_builderRange≤3.7.4wordpress

VendorProductVersionCPE
whitestudioeasy_form_builder*cpe:2.3:a:whitestudio:easy_form_builder:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
whitestudio	easy_form_builder	*	cpe:2.3:a:whitestudio:easy_form_builder::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "easy-form-builder",
    "product": "Easy Form Builder",
    "vendor": "WhiteStudio",
    "versions": [
      {
        "changes": [
          {
            "at": "3.7.5",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.7.4",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/easy-form-builder/wordpress-easy-form-builder-plugin-3-7-4-sql-injection-vulnerability?_s_id=cve

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

AI Score

9.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-30535