PT-2024-35255 · Skpstorm · Skpstorm Sk Wp Settings Backup

Mika · Published 2024-11-16 · Updated 2024-11-18 · CVE-2024-52415

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Skpstorm SK WP Settings Backup versions n/a through 1.0

Description A Cross-Site Request Forgery (CSRF) vulnerability in Skpstorm SK WP Settings Backup allows Object Injection. This issue enables an attacker to inject objects, potentially leading to unauthorized actions on the affected system.

Recommendations For versions n/a through 1.0, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating request origins and using anti-CSRF tokens, until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-52415

Affected Products

Skpstorm Sk Wp Settings Backup

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-52415 · Security Note
• https://twitter.com/CVEnew/status/1857901068325154939 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/sk-wp-settings-backup/vulnerability/wordpress-sk-wp-settings-backup-plugin-1-0-csrf-to-php-object-injection-vulnerability?_s_id=cve · Note
• https://t.me/latest_high_impact_cve/1526 · Telegram Post
• https://twitter.com/CveFindCom/status/1857899260236157222 · Twitter Post
• https://patchstack.com/database/vulnerability/sk-wp-settings-backup/wordpress-sk-wp-settings-backup-plugin-1-0-csrf-to-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1857940160379260983 · Twitter Post
• https://t.me/cvedetector/11233 · Telegram Post