PT-2024-27296 · Blossom Themes · Blossomthemes Email Newsletter

Yuchen Ji · Published 2024-06-26 · Updated 2024-06-26 · CVE-2024-37098

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlossomThemes Email Newsletter versions 2.2.6 and earlier

Description A Server-Side Request Forgery (SSRF) issue has been identified. This allows an attacker to trick the server into making unintended requests, potentially leading to unauthorized access to sensitive data or systems.

Recommendations For versions 2.2.6 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-37098

Affected Products

Blossomthemes Email Newsletter

References · 4

• https://osv.dev/vulnerability/CVE-2024-37098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37098 · Security Note
• https://t.me/cvenotify/84461 · Telegram Post
• https://patchstack.com/database/vulnerability/blossomthemes-email-newsletter/wordpress-blossomthemes-email-newsletter-plugin-2-2-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve · Note