PT-2024-17672 · WordPress · Calculated Fields Form

B0Lli + 1 · Published 2024-12-17 · Updated 2024-12-17 · CVE-2024-12601

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Calculated Fields Form plugin for WordPress versions up to, and including, 5.2.63

Description The issue is related to unlimited height and width parameters for CAPTCHA images, allowing unauthenticated attackers to send multiple requests with large values. This results in slowing server resources if the server does not mitigate Denial of Service attacks. The attackers can exploit this by sending requests with large values for the height and width parameters of the CAPTCHA images.

Recommendations For versions up to, and including, 5.2.63, update to a version higher than 5.2.63 to resolve the issue. As a temporary workaround, consider restricting access to the CAPTCHA image generation functionality to minimize the risk of exploitation. Restrict the height and width parameters for CAPTCHA images to prevent attackers from sending requests with large values.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-12601

Affected Products

Calculated Fields Form

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-12601 · Security Note
• https://plugins.trac.wordpress.org/changeset/3207826 · Patch
• https://osv.dev/vulnerability/CVE-2024-12601 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/trunk/captcha/captcha.php#L75 · Note
• https://t.me/cvedetector/13085 · Telegram Post
• https://twitter.com/CVEnew/status/1869005768571470288 · Twitter Post
• https://t.me/cvenotify/104509 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1eade2ed-9a75-4857-a2c5-a21e016e7029?source=cve · Note
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/trunk/captcha/captcha.php#L74 · Note