6.5

CVE-2024-3591

Exploit

Geo Controller <= 8.6.4 - Unauthenticated PHP Object Injection via shortcode REST API Route

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Mögliche Gegenmaßnahme
Geo Controller: Update to version 8.6.5, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Geo Controller
Version *-8.6.4
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Infinitumform ≫ Geo Controller SwPlatformwordpress Version < 8.6.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.607
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.