Lucene search

PatchstackCVE-2024-33542

HistoryApr 29, 2024 - 6:15 a.m.

CVE-2024-33542

2024-04-2906:15:10

CWE-639

Patchstack

web.nvd.nist.gov

cve-2024-33542

authorization bypass

fabio rinaldi

crelly slider

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5.

Affected configurations

Vulners

Node

fabio_rinaldicrelly_sliderRange≤1.4.5wordpress

VendorProductVersionCPE
fabio_rinaldicrelly_slider*cpe:2.3:a:fabio_rinaldi:crelly_slider:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
fabio_rinaldi	crelly_slider	*	cpe:2.3:a:fabio_rinaldi:crelly_slider::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "crelly-slider",
    "product": "Crelly Slider",
    "vendor": "Fabio Rinaldi",
    "versions": [
      {
        "changes": [
          {
            "at": "1.4.6",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.4.5",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/crelly-slider/wordpress-crelly-slider-plugin-1-4-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-33542