PT-2024-34201 · WordPress · Surveyjs: Drag & Drop Wordpress Form Builder

Stealthcopter · Published 2024-10-29 · Updated 2024-10-29 · CVE-2024-50427

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SurveyJS: Drag & Drop WordPress Form Builder versions 1.9.136 and earlier

Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability. This means that the software may allow uploading files of dangerous types without proper restrictions, potentially leading to security issues.

Recommendations: For SurveyJS: Drag & Drop WordPress Form Builder versions 1.9.136 and earlier, consider restricting file uploads to only necessary and safe file types until a fix is available. As a temporary workaround, disabling the file upload feature may help minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-50427

Affected Products

Surveyjs: Drag & Drop Wordpress Form Builder

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-50427 · Security Note
• https://t.me/cvedetector/9262 · Telegram Post
• https://patchstack.com/database/vulnerability/surveyjs/wordpress-surveyjs-plugin-1-9-136-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/latest_high_impact_cve/1415 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/surveyjs/vulnerability/wordpress-surveyjs-plugin-1-9-136-arbitrary-file-upload-vulnerability?_s_id=cve · Note