PT-2024-28191 · Woocommerce · Hitpay Payment Gateway For Woocommerce

Joshua Chan · Published 2024-08-13 · Updated 2024-08-17 · CVE-2024-38747

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HitPay Payment Gateway for WooCommerce versions n/a through 4.1.3

Description The issue affects the HitPay Payment Gateway for WooCommerce, allowing unauthorized access to sensitive information due to improperly constrained functionality by Access Control Lists (ACLs). This enables accessing functionality not properly restricted.

Recommendations For versions n/a through 4.1.3, update to a version later than 4.1.3 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-38747

Affected Products

Hitpay Payment Gateway For Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-38747 · Security Note
• https://t.me/cvedetector/3004 · Telegram Post
• https://twitter.com/CVEnew/status/1823307477284467088 · Twitter Post
• https://patchstack.com/database/vulnerability/hitpay-payment-gateway/wordpress-hitpay-payment-gateway-for-woocommerce-plugin-4-1-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1825050067088322801 · Twitter Post
• https://t.me/cvenotify/90234 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823308642180837406 · Twitter Post