PT-2019-11675 · WordPress · Ultimate Member

Clément Cruchet · Publicado 2019-06-24 · Atualizado 2024-03-05 · CVE-2019-10271

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin version 2.39

Description An issue in the Ultimate Member plugin for WordPress allows unauthorized modification of user profiles and cover pictures. Once connected, an attacker can modify the profile and cover picture of any user, including those of privileged users. To exploit this, an attacker would need to intercept an upload-picture request and modify the user id parameter.

Recommendations For Ultimate Member plugin version 2.39, consider disabling the profile and cover picture modification functionality until a patch is available. Restrict access to the upload-picture request to minimize the risk of exploitation. Avoid using the user id parameter in the affected request until the issue is resolved.

Correção

Identificadores relacionados

CVE-2019-10271

Produtos afetados

Ultimate Member

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-10271 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10271 · Nota de Segurança
• https://t.me/cvenotify/73071 · Publicação no Telegram
• https://cxsecurity.com/issue/WLB-2019060120 · Nota