PT-2024-15763 · Unknown · Oliver Pos

Francesco Carlucci · Published 2024-02-20 · Updated 2024-02-29 · CVE-2024-0702

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions The Oliver POS versions up to, and including, 2.4.1.8

Description The issue is related to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file. This allows authenticated attackers with subscriber-level access and above to perform unauthorized actions, such as deactivating the plugin, disconnecting the subscription, and syncing the status.

Recommendations For versions up to, and including, 2.4.1.8, consider disabling the affected functions hooked via AJAX in the includes/class-pos-bridge-install.php file as a temporary workaround until a patch is available. Restrict access to the class-pos-bridge-install.php file to minimize the risk of exploitation. Avoid using the affected AJAX endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-0702

Affected Products

Oliver Pos

References · 6

• https://osv.dev/vulnerability/CVE-2024-0702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0702 · Security Note
• https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-install.php#L11 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b5c6f351-477b-4384-9863-fe3b45ddf21d?source=cve · Note
• https://twitter.com/CVEnew/status/1760019581500891506 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038694%40oliver-pos&new=3038694%40oliver-pos&sfp_email=&sfph_mail= · Note