2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Email Log","vendor":"webfactory","versions":[{"lessThanOrEqual":"2.4.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"},{"affectedData":[{"cpes":["cpe:2.3:a:sudar:email_log:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"email_log","vendor":"sudar","versions":[{"lessThanOrEqual":"2.4.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement."},{"lang":"es","value":"El complemento Email Log para WordPress es vulnerable a la inyección de gancho no autenticado en todas las versiones hasta la 2.4.8 incluida a través de la función check_nonce. Esto hace posible que atacantes no autenticados ejecuten acciones con ganchos en WordPress bajo ciertas circunstancias. La acción que el atacante desea ejecutar debe tener una verificación de nonce, y el atacante debe conocer el nonce. Además, es un requisito la ausencia de una verificación de capacidad."}],"id":"CVE-2024-0867","lastModified":"2026-06-17T06:54:27.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-0867","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-05-24T14:52:31.738479Z","version":"2.0.3"}}]},"published":"2024-05-24T06:15:08.380","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027872%40email-log&new=3027872%40email-log&sfp_email=&sfph_mail="},{"source":"security@wordfence.com","url":"https://wordpress.org/plugins/email-log/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd15268f-7e06-4e0d-baaf-f27348af61ce?source=cve"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027872%40email-log&new=3027872%40email-log&sfp_email=&sfph_mail="},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://wordpress.org/plugins/email-log/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd15268f-7e06-4e0d-baaf-f27348af61ce?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@wordfence.com","type":"Secondary"}]}
|