PT-2024-19020 · WordPress · Web Application Firewall+1

Stiofan + 1 · Published 2024-03-13 · Updated 2024-03-25 · CVE-2024-2172

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Malware Scanner plugin versions up to, and including, 4.7.2 Web Application Firewall plugin versions up to, and including, 2.1.1

Description The issue is related to a missing capability check on the mo wpns init() function, which allows unauthenticated attackers to escalate their privileges to that of an administrator. This makes it possible for attackers to gain administrative privileges to the site.

Recommendations For Malware Scanner plugin versions up to, and including, 4.7.2, update to a version later than 4.7.2 to resolve the issue. For Web Application Firewall plugin versions up to, and including, 2.1.1, update to a version later than 2.1.1 to resolve the issue. As a temporary workaround, consider disabling the mo wpns init() function until a patch is available.

Fix

Weakness Enumeration

CWE-304

Related Identifiers

CVE-2024-2172

Affected Products

Malware Scanner

Web Application Firewall

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-2172 · Security Note
• https://wordpress.org/plugins/miniorange-malware-protection · Note
• https://twitter.com/jbhall56/status/1769708517844296036 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3054179%40miniorange-malware-protection&new=3054179%40miniorange-malware-protection&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6347f588-a3fd-4909-ad57-9d78787b5728?source=cve · Note
• https://twitter.com/rfwaveio/status/1769763269617553788 · Twitter Post
• https://plugins.trac.wordpress.org/browser/miniorange-malware-protection/tags/4.7.2/handler/login.php#L89 · Note
• https://twitter.com/SecWillCheck/status/1772437816859095438 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3054255%40web-application-firewall&new=3054255%40web-application-firewall&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1767938614871347367 · Twitter Post