Lucene search

WordfenceCVE-2024-7423

HistorySep 13, 2024 - 3:15 p.m.

CVE-2024-7423

2024-09-1315:15:16

CWE-352

Wordfence

web.nvd.nist.gov

wordpress

cross-site request forgery

nonce validation

dos

privilege escalation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can lead to DoS or privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected configurations

Vulners

Vulnrichment

Node

xwpstreamRange≤4.0.1wordpress

VendorProductVersionCPE
xwpstream*cpe:2.3:a:xwp:stream:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
xwp	stream	*	cpe:2.3:a:xwp:stream::::::wordpress::*

CNA Affected

[
  {
    "vendor": "xwp",
    "product": "Stream",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "4.0.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/stream/tags/4.0.1/classes/class-network.php#L353

plugins.trac.wordpress.org/changeset/3139815/stream/trunk/classes/class-network.php

www.wordfence.com/threat-intel/vulnerabilities/id/9d15e418-36bb-4f53-ac67-8f6122591dd2?source=cve

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

Related for CVE-2024-7423