PT-2025-1634 · WordPress · The Passster

Francesco Carlucci · Publicado 2025-01-07 · Atualizado 2025-01-07 · CVE-2024-11282

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Passster – Password Protect Pages and Content plugin for WordPress versions up to, and including, 4.2.10

Description The issue allows unauthenticated attackers to extract sensitive data from posts restricted to higher-level roles, such as administrators, via the WordPress core search feature. This makes it possible for attackers to access information that should be protected.

Recommendations For versions up to, and including, 4.2.10, update to a version later than 4.2.10 to resolve the issue. As a temporary workaround, consider restricting access to the WordPress core search feature until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2024-11282

Produtos afetados

The Passster

Referências · 7

• https://twitter.com/CVEnew/status/1876522554263064855 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-11282 · Nota de Segurança
• https://t.me/cvedetector/14494 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/11782a65-30b9-400e-8fe0-ab9f05ba5e42?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3211004/content-protector · Correção
• https://t.me/cvenotify/106520 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2024-11282 · Aviso do Fabricante