CVE-2024-6467

EPSS 0.81%
Veröffentlicht 17.07.2024 07:15:03
Zuletzt bearbeitet 21.11.2024 09:49:42
Quelle security@wordfence.com
Teams Watchlist Login
Unerledigt Login

The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File Creation in all versions up to, and including, 1.1.5 via the 'bookingpress_save_lite_wizard_settings_func' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary files that contain the content of files on the server, allowing the execution of any PHP code in those files or the exposure of sensitive information.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Reputeinfosystems ≫ Bookingpress SwPlatformwordpress Version < 1.1.6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.81%	0.734

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
security@wordfence.com	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

https://plugins.trac.wordpress.org/changeset/3116857/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress.php

Patch

https://www.wordfence.com/threat-intel/vulnerabilities/id/d0177510-cd7d-4cc5-96c3-78433aa0e3f6?source=cve

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-6467

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-6467

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-6467

EUVD