PT-2024-12479 · Unknown · Constant Contact Forms

István Márton · Published 2024-12-13 · Updated 2024-12-16 · CVE-2023-34387

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Constant Contact Forms versions 1.14.0 through 2.0.3 Constant Contact Forms version prior to the latest version

Description The issue is related to a Missing Authorization vulnerability in Constant Contact Forms, allowing exploitation of incorrectly configured access control security levels. This involves broken access control, which can be exploited due to missing authorization.

Recommendations For Constant Contact Forms versions 1.14.0 through 2.0.3, update to the latest version to secure your site. For versions prior to the latest version, update to the latest version of the plugin to protect your site.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-34387

Affected Products

Constant Contact Forms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-34387 · Security Note
• https://twitter.com/CVEnew/status/1868033870790279355 · Twitter Post
• https://twitter.com/transilienceai/status/1868524690190266812 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/constant-contact-forms/vulnerability/wordpress-constant-contact-forms-plugin-1-14-0-broken-access-control-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/constant-contact-forms/vulnerability/wordpress-constant-contact-forms-plugin-1-14-0-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/transilienceai/status/1868524699635888399 · Twitter Post