PT-2024-28220 · Unknown · Codection Import/Export Users/Customers

Emad · Published 2024-08-13 · Updated 2024-08-17 · CVE-2024-38787

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Codection Import and export users and customers versions n/a through 1.26.8

Description The issue allows exposure of sensitive information to an unauthorized actor due to accessing functionality not properly constrained by ACLs. This affects the import and export users and customers functionality.

Recommendations For versions n/a through 1.26.8, update to a version that properly constrains functionality by ACLs to prevent unauthorized access to sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

CVE-2024-38787

Affected Products

Codection Import/Export Users/Customers

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-38787 · Security Note
• https://twitter.com/cracbot/status/1825050068573200853 · Twitter Post
• https://t.me/cvedetector/2995 · Telegram Post
• https://twitter.com/CVEnew/status/1823311376040804422 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-1-26-8-sensitive-information-via-imported-file-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-26-8-sensitive-information-via-imported-file-vulnerability?_s_id=cve · Note
• https://twitter.com/PorsilapongoCl/status/1823312522126021096 · Twitter Post
• https://t.me/cvenotify/90239 · Telegram Post