Lucene search

WordfenceCVE-2024-8761

HistorySep 17, 2024 - 9:15 a.m.

CVE-2024-8761

2024-09-1709:15:03

CWE-601

Wordfence

web.nvd.nist.gov

share this image

wordpress

open redirect

vulnerable

insufficient validation

unauthenticated attackers

malicious sites

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.4%

JSON

The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on the redirect url supplied via the link parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

wp-unitshare_this_imageRange<2.04wordpress

VendorProductVersionCPE
wp-unitshare_this_image*cpe:2.3:a:wp-unit:share_this_image:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wp-unit	share_this_image	*	cpe:2.3:a:wp-unit:share_this_image::::::wordpress::*

CNA Affected

[
  {
    "vendor": "mihail-barinov",
    "product": "Share This Image",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.03",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/assets/js/sti.js#L693

plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/includes/class-sti-shortlink.php#L64

plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/includes/class-sti-shortlink.php#L74

plugins.trac.wordpress.org/changeset/3152564/

wordpress.org/plugins/share-this-image/#developers

www.wordfence.com/threat-intel/vulnerabilities/id/1e72d5c7-c601-4775-a825-4786bbd1b5f0?source=cve

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.4%

JSON

Related for CVE-2024-8761