Lucene search

K
cvelistPatchstackCVELIST:CVE-2024-23512
HistoryFeb 12, 2024 - 8:22 a.m.

CVE-2024-23512 WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection

2024-02-1208:22:30
CWE-502
Patchstack
www.cve.org
4
wordpress
productx
gutenberg
woocommerce
php object injection
vulnerability
deserialization
untrusted data

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0

Percentile

9.0%

Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: from n/a through 3.1.4.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "product-blocks",
    "product": "ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks",
    "vendor": "wpxpo",
    "versions": [
      {
        "changes": [
          {
            "at": "3.1.5",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.1.4",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0

Percentile

9.0%

Related for CVELIST:CVE-2024-23512