CVE-2024-6467

EPSS 0.81%
Published 17.07.2024 07:15:03
Last modified 21.11.2024 09:49:42
Source security@wordfence.com
Teams watchlist Login
Open Login

The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File Creation in all versions up to, and including, 1.1.5 via the 'bookingpress_save_lite_wizard_settings_func' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary files that contain the content of files on the server, allowing the execution of any PHP code in those files or the exposure of sensitive information.

Affected products Warnungen 0 Metrics 2 CWE 0 References 5

Data is provided by the National Vulnerability Database (NVD)

Reputeinfosystems ≫ Bookingpress SwPlatformwordpress Version < 1.1.6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.81%	0.734

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
security@wordfence.com	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

https://plugins.trac.wordpress.org/changeset/3116857/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress.php

Patch

https://www.wordfence.com/threat-intel/vulnerabilities/id/d0177510-cd7d-4cc5-96c3-78433aa0e3f6?source=cve

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-6467

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-6467

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-6467

EUVD