PT-2024-23008 · Mollie · Doneren Met Mollie

Dimas Maulana · Published 2024-03-27 · Updated 2024-04-02 · CVE-2024-29767

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Doneren met Mollie versions 2.10.2 and earlier

Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Reflected XSS. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations For Doneren met Mollie versions 2.10.2 and earlier, update the plugin to a version later than 2.10.2 as soon as possible. If the update is not available, avoid using the plugin until it is fixed. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-29767

Affected Products

Doneren Met Mollie

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-29767 · Security Note
• https://patchstack.com/database/vulnerability/doneren-met-mollie/wordpress-doneren-met-mollie-plugin-2-10-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/oktsec/status/1775116420583420275 · Twitter Post
• https://twitter.com/CVEnew/status/1772975951715959160 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1773000322639634492 · Twitter Post