2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ninja Tables – Easy Data Table Builder","vendor":"techjewel","versions":[{"lessThanOrEqual":"5.0.18","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wpmanageninja:ninja_tables:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"293115CD-8B07-4174-B9D0-B52CE7E4A80A","versionEndExcluding":"5.0.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited."},{"lang":"es","value":"El complemento Ninja Tables – Easy Data Table Builder para WordPress es vulnerable a la inyección de objetos PHP en todas las versiones hasta la 5.0.18 incluida, mediante la deserialización de entradas no confiables del parámetro args[callback]. Esto permite a atacantes no autenticados inyectar un objeto PHP. La presencia adicional de una cadena POP permite a los atacantes ejecutar funciones arbitrarias, aunque no permite parámetros proporcionados por el usuario; solo se pueden invocar funciones individuales, por lo que el impacto es limitado."}],"id":"CVE-2025-2939","lastModified":"2026-06-17T09:07:53.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2939","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-06-03T14:51:18.334809Z","version":"2.0.3"}}]},"published":"2025-06-03T03:15:27.137","references":[{"source":"security@wordfence.com","tags":["Product"],"url":"https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.18/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L399"},{"source":"security@wordfence.com","tags":["Product"],"url":"https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.19/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L399"},{"source":"security@wordfence.com","tags":["Product"],"url":"https://plugins.trac.wordpress.org/browser/ninja-tables/trunk/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L399"},{"source":"security@wordfence.com","tags":["Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e38553d-5dba-4c84-95f7-43420245c770?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@wordfence.com","type":"Secondary"}]}
|