Lucene search

K
cvelistPatchstackCVELIST:CVE-2024-38787
HistoryAug 13, 2024 - 10:33 a.m.

CVE-2024-38787 WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability

2024-08-1310:33:21
CWE-200
Patchstack
www.cve.org
3
wordpress
import and export users
customers
sensitive information
unauthorized access
acls
codection
vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

9.5%

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Codection Import and export users and customers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Import and export users and customers: from n/a through 1.26.8.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "import-users-from-csv-with-meta",
    "product": "Import and export users and customers",
    "vendor": "Codection",
    "versions": [
      {
        "changes": [
          {
            "at": "1.26.9",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.26.8",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

9.5%

Related for CVELIST:CVE-2024-38787