Lucene search

CloudflareCVELIST:CVE-2024-0212

HistoryJan 29, 2024 - 9:13 a.m.

CVE-2024-0212 Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)

2024-01-2909:13:44

CWE-284

cloudflare

www.cve.org

cve-2024-0212

cloudflare

wordpress

plugin

information disclosure

api

low privileged users

improper authentication

vulnerability

attackers

data

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

8.1 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "Cloudflare-WordPress",
    "platforms": [
      "Wordpress"
    ],
    "product": "Cloudflare-WordPress",
    "repo": "https://github.com/cloudflare/Cloudflare-WordPress",
    "vendor": "Cloudflare",
    "versions": [
      {
        "changes": [
          {
            "at": "4.12.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.12.2",
        "status": "affected",
        "version": "0",
        "versionType": "patch"
      }
    ]
  }
]

References

github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3

github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

8.1 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Related for CVELIST:CVE-2024-0212