Lucene search

K
cvelistPatchstackCVELIST:CVE-2024-33944
HistoryMay 02, 2024 - 11:26 a.m.

CVE-2024-33944 WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability

2024-05-0211:26:48
CWE-862
Patchstack
www.cve.org
4
cve-2024
wordpress
woocommerce
aweber
newsletter
unauthenticated
access token
change
reset
vulnerability
missing authorization
kestrel

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

7.4

Confidence

High

EPSS

0

Percentile

9.0%

Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n/a through 4.0.2.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "WooCommerce AWeber Newsletter Subscription",
    "vendor": "Kestrel",
    "versions": [
      {
        "changes": [
          {
            "at": "4.0.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.0.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

7.4

Confidence

High

EPSS

0

Percentile

9.0%

Related for CVELIST:CVE-2024-33944