PT-2024-36255 · Unknown · Zita Site Builder

Stealthcopter · Published 2024-12-16 · Updated 2024-12-16 · CVE-2024-54369

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zita Site Builder versions 1.0.2 and earlier

Description: The issue is related to a missing authorization vulnerability in Zita Site Builder, which allows accessing functionality not properly constrained by Access Control Lists (ACLs). This means that certain features or areas of the site builder are not correctly restricted, potentially allowing unauthorized access.

Recommendations: For Zita Site Builder versions 1.0.2 and earlier, update to a version that includes the necessary authorization constraints to prevent unauthorized access to functionality. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-54369

Affected Products

Zita Site Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-54369 · Security Note
• https://twitter.com/CVEnew/status/1868670254408196534 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/ai-site-builder/vulnerability/wordpress-zita-site-builder-plugin-1-0-2-arbitrary-plugin-installation-and-activation-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/ai-site-builder/vulnerability/wordpress-zita-site-builder-plugin-1-0-2-arbitrary-plugin-installation-and-activation-vulnerability?_s_id=cve · Note