2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CM Table Of Contents","vendor":"Unknown","versions":[{"lessThan":"1.2.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"},{"affectedData":[{"cpes":["cpe:2.3:a:cminds:cm_table_of_contents:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"cm_table_of_contents","vendor":"cminds","versions":[{"lessThan":"1.2.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cminds:cm_table_of_contents:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"16E4B695-B02D-4C23-B861-86F05858F2BF","versionEndExcluding":"1.2.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack."},{"lang":"es","value":"El complemento CM Table Of Contents de WordPress anterior a 1.2.4 no tiene verificación CSRF al actualizar su configuración y le falta saneamiento y escape, lo que podría permitir a los atacantes hacer que el administrador que haya iniciado sesión agregue payloads XSS almacenados a través de un ataque CSRF."}],"id":"CVE-2024-5029","lastModified":"2026-06-17T08:14:56.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-5029","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-11-21T21:46:28.583817Z","version":"2.0.3"}}]},"published":"2024-11-21T11:15:35.790","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/f0f4a33c-9dd2-45ee-82e7-4b8bc2c20094/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"nvd@nist.gov","type":"Primary"}]}
|