2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Check & Log Email – Easy Email Testing & Mail logging","vendor":"checkemail","versions":[{"lessThanOrEqual":"1.0.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"},{"affectedData":[{"cpes":["cpe:2.3:a:checkmail:check_and_log_email:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"check_and_log_email","vendor":"checkmail","versions":[{"lessThanOrEqual":"1.0.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement."},{"lang":"es","value":"El complemento Check & Log Email para WordPress es vulnerable a la inyección de gancho no autenticado en todas las versiones hasta la 1.0.9 incluida a través de la función check_nonce. Esto hace posible que atacantes no autenticados ejecuten acciones con ganchos en WordPress bajo ciertas circunstancias. La acción que el atacante desea ejecutar debe tener una verificación de nonce, y el atacante debe conocer el nonce. Además, es un requisito la ausencia de una verificación de capacidad."}],"id":"CVE-2024-0866","lastModified":"2026-06-17T06:54:27.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-0866","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-08-02T16:14:21.149188Z","version":"2.0.3"}}]},"published":"2024-03-26T03:15:12.980","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail="},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail="},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@wordfence.com","type":"Secondary"}]}
|