PT-2024-23604 · Sendlayer · Easy Wp Smtp

Andy Gilbert + 1 · Published 2024-06-13 · Updated 2024-07-15 · CVE-2024-3073

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin versions prior to 2.3.1

Description The plugin is vulnerable to information exposure due to providing the SMTP password in the SMTP Password field when viewing the settings. This allows authenticated attackers with administrative-level access and above to view the SMTP password for the supplied server. Although this information may not be useful to attackers in most cases, it could be valuable if an administrator account becomes compromised in a limited environment.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SMTP Password field to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-257

Related Identifiers

CVE-2024-3073

Affected Products

Easy Wp Smtp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-3073 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3073 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3101553%40easy-wp-smtp&new=3101553%40easy-wp-smtp&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b043197c-4477-4663-abb8-5840173c574d?source=cve · Note
• https://t.me/cvenotify/83144 · Telegram Post
• https://t.me/cvenotify/86241 · Telegram Post