PT-2024-36738 · Unknown · George Holmes Ii Wayne Audio Player

Mika · Published 2024-12-31 · Updated 2024-12-31 · CVE-2024-56203

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions George Holmes II Wayne Audio Player versions n/a through 1.0

Description A Cross-Site Request Forgery (CSRF) issue is present in the George Holmes II Wayne Audio Player, allowing Privilege Escalation. This can lead to unauthorized actions being performed on behalf of the user.

Recommendations For versions n/a through 1.0, as a temporary workaround, consider implementing CSRF token validation to prevent unauthorized requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-56203

Affected Products

George Holmes Ii Wayne Audio Player

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-56203 · Security Note
• https://twitter.com/VulmonFeeds/status/1874158076116312218 · Twitter Post
• https://t.me/cvedetector/14022 · Telegram Post
• https://t.me/latest_high_impact_cve/1741 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/wayne-audio-player/vulnerability/wordpress-wayne-audio-player-plugin-1-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/wayne-audio-player/vulnerability/wordpress-wayne-audio-player-plugin-1-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/105836 · Telegram Post
• https://twitter.com/CVEnew/status/1874087596315341003 · Twitter Post
• https://twitter.com/CveFindCom/status/1874086035971297522 · Twitter Post