PT-2024-11911 · Freemius · Freemius Sdk

James Marsland + 2 · Published 2024-10-15 · Updated 2024-10-16 · CVE-2022-4974

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Freemius SDK versions up to, and including 2.4.2 Freemius SDK versions prior to 2.4.3

Description The issue concerns Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the checkPassword() is not mentioned but the following functions are: get debug log, get db option, and the set db option functions.

Recommendations For Freemius SDK versions up to, and including 2.4.2, update to version 2.4.3 or later. For Freemius SDK versions prior to 2.4.3, update to version 2.4.3 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-4974

Affected Products

Freemius Sdk

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-4974 · Security Note
• https://freemius.com/blog/managing-security-issues-open-source-freemius-sdk-security-disclosure · Note
• https://twitter.com/CVEnew/status/1846444832559931470 · Twitter Post
• https://wpdirectory.net/search/01FWPVWA7BC5DYGZHNSZQ9QMN5 · Note
• https://web.archive.org/web/20220225174410/https%3A//www.pluginvulnerabilities.com/2022/02/25/our-security-review-of-wordpress-plugin-found-freemius-library-still-contained-vulnerabilities-3-years-after-major-security-incident · Note
• https://t.me/cvedetector/8019 · Telegram Post
• https://wpscan.com/vulnerability/6dae6dca-7474-4008-9fe5-4c62b9f12d0a · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=cve · Note
• https://wpdirectory.net/search/01G02RSGMFS1TPT63FS16RWEYR · Note