Lucene search

K
cve[email protected]CVE-2024-3585
HistoryMay 02, 2024 - 5:15 p.m.

CVE-2024-3585

2024-05-0217:15:27
web.nvd.nist.gov
21
cve-2024-3585
vulnerability
send pdf
contact form 7 plugin
wordpress
unauthorized access
capability check
hooks function
information disclosure
unauthenticated attackers
pdfs

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.5%

The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks function in all versions up to, and including, 1.0.2.3. This makes it possible for unauthenticated attackers to download information about contact form entries with PDFs.

Affected configurations

Vulners
Node
florent73send_pdf_for_contact_form_7Range1.0.2.3

CNA Affected

[
  {
    "vendor": "florent73",
    "product": "Send PDF for Contact Form 7",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.0.2.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.5%

Related for CVE-2024-3585