Lucene search

WPScanCVE-2024-6925

HistorySep 08, 2024 - 6:15 a.m.

CVE-2024-6925

2024-09-0806:15:02

CWE-352

WPScan

web.nvd.nist.gov

truebooker

wordpress

csrf

vulnerability

version 1.0.3

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

themetechmounttruebookerRange≤1.0.2wordpress

VendorProductVersionCPE
themetechmounttruebooker*cpe:2.3:a:themetechmount:truebooker:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
themetechmount	truebooker	*	cpe:2.3:a:themetechmount:truebooker::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "TrueBooker",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.0.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/1da75fd7-e44f-4043-b8f4-7ee975356982/

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2024-6925