2 lines
3.9 KiB
JSON
2 lines
3.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PPWP – Password Protect Pages","vendor":"buildwps","versions":[{"lessThanOrEqual":"1.8.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"},{"affectedData":[{"cpes":["cpe:2.3:a:bwps:ppwp:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"ppwp","vendor":"bwps","versions":[{"lessThanOrEqual":"1.8.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:passwordprotectwp:password_protect_wordpress:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"579C0428-FCC3-4DC3-B50A-BB8854B10D3B","versionEndExcluding":"1.9.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. This makes it possible for unauthenticated attackers to obtain post titles, IDs, slugs as well as other information including for password-protected posts."},{"lang":"es","value":"El complemento PPWP – Password Protect Pages para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 1.8.9 incluida a través de API. Esto hace posible que atacantes no autenticados obtengan títulos de publicaciones, ID, slugs y otra información, incluso para publicaciones protegidas con contraseña."}],"id":"CVE-2024-0620","lastModified":"2026-06-17T06:53:54.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-0620","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-08-07T17:31:44.966976Z","version":"2.0.3"}}]},"published":"2024-02-29T01:43:23.493","references":[{"source":"security@wordfence.com","tags":["Patch"],"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3032733%40password-protect-page%2Ftrunk&old=3010000%40password-protect-page%2Ftrunk&sfp_email=&sfph_mail="},{"source":"security@wordfence.com","tags":["Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41299927-2ed9-4cbe-b2b0-f306dc0e4a58?source=cve"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3032733%40password-protect-page%2Ftrunk&old=3010000%40password-protect-page%2Ftrunk&sfp_email=&sfph_mail="},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41299927-2ed9-4cbe-b2b0-f306dc0e4a58?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@wordfence.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Secondary"}]}
|