PT-2024-25447 · Unknown · Optinmonster

Dhabaleshwar Das · Published 2024-04-26 · Updated 2024-04-26 · CVE-2024-33691

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OptinMonster versions through 2.15.3

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability in OptinMonster Popup Builder. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to.

Recommendations For versions through 2.15.3, update to a version later than 2.15.3 to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-33691

Affected Products

Optinmonster

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-33691 · Security Note
• https://twitter.com/linuxpatch/status/1783860767801962979 · Twitter Post
• https://twitter.com/CVEnew/status/1783847655556157650 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1783881895769452554 · Twitter Post
• https://patchstack.com/database/vulnerability/optinmonster/wordpress-popup-builder-by-optinmonster-plugin-2-15-3-cross-site-request-forgery-csrf-notice-dismissal-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/78155 · Telegram Post
• https://t.me/cvenotify/78173 · Telegram Post