Lucene search

PatchstackCVE-2024-35777

HistoryJul 09, 2024 - 10:15 a.m.

CVE-2024-35777

2024-07-0910:15:03

CWE-74

Patchstack

web.nvd.nist.gov

content spoofing

injection

automattic woocommerce

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

AI Score

4.1

Confidence

High

EPSS

Percentile

9.2%

JSON

Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2.

Affected configurations

Vulners

Node

automatticwoocommerceRange≤8.9.2wordpress

VendorProductVersionCPE
automatticwoocommerce*cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
automattic	woocommerce	*	cpe:2.3:a:automattic:woocommerce::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "woocommerce",
    "product": "WooCommerce",
    "vendor": "Automattic",
    "versions": [
      {
        "changes": [
          {
            "at": "9.0.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "8.9.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-9-2-content-injection-vulnerability?_s_id=cve