PT-2024-30598 · WordPress · Tablepress

Kun_19 + 1 · Published 2024-06-06 · Updated 2024-07-18 · CVE-2024-4354

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TablePress – Tables in WordPress made easy plugin for WordPress versions prior to 2.3

Description The issue allows authenticated attackers with author-level access and above to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. This is possible due to a Server-Side Request Forgery vulnerability in the get files to import() function. The vulnerability poses a minimal risk to most site owners, and ideally, WordPress core would correct this issue in wp safe remote get() and other functions.

Recommendations For versions prior to 2.3, restrict the usage of the URL import functionality to just administrators as a temporary workaround until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-4354

Affected Products

Tablepress

References · 10

• https://plugins.trac.wordpress.org/browser/tablepress/trunk/classes/class-import.php#L141 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-4354 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4354 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097113%40tablepress&new=3097113%40tablepress&sfp_email=&sfph_mail= · Patch
• https://plugins.trac.wordpress.org/browser/tablepress/trunk/classes/class-import.php#L125 · Patch
• https://t.me/cvenotify/86634 · Telegram Post
• https://twitter.com/CVEnew/status/1798953139795558512 · Twitter Post
• https://clear-gate.com/blog/ssrf-with-dns-rebinding-2 · Note
• https://t.me/cvenotify/82248 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/879384eb-bfea-4667-a7de-9f723dbea74b?source=cve · Note