Lucene search

K
vulnrichmentPatchstackVULNRICHMENT:CVE-2024-38772
HistoryAug 01, 2024 - 8:49 p.m.

CVE-2024-38772 WordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerability

2024-08-0120:49:54
CWE-22
Patchstack
github.com
3
wordpress
jetwidgets
elementor
woocommerce
cve-2024-38772
path traversal
crocoblock
php
local file inclusion
security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0

Percentile

11.0%

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7.

CNA Affected

[
  {
    "vendor": "Crocoblock",
    "product": "JetWidgets for Elementor and WooCommerce",
    "versions": [
      {
        "status": "affected",
        "changes": [
          {
            "at": "1.1.8",
            "status": "unaffected"
          }
        ],
        "version": "n/a",
        "versionType": "custom",
        "lessThanOrEqual": "1.1.7"
      }
    ],
    "packageName": "jetwoo-widgets-for-elementor",
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:crocoblock:jetwidgets_for_elementor:*:*:*:*:*:*:*:*"
    ],
    "vendor": "crocoblock",
    "product": "jetwidgets_for_elementor",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.1.7"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0

Percentile

11.0%

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Related for VULNRICHMENT:CVE-2024-38772