PT-2024-37676 · Unknown · Mrw Plugin

Jesús Higueras · Published 2024-07-04 · Updated 2024-07-08 · CVE-2024-6506

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions MRW plugin version 5.4.3

Description The issue is an information exposure vulnerability affecting the "mrw log" functionality. This could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. The vulnerability also allows an attacker to create or overwrite shipping labels.

Recommendations For MRW plugin version 5.4.3, consider disabling the "mrw log" functionality until a patch is available. Restrict access to sensitive customer information to minimize the risk of exploitation. Avoid using the affected functionality to prevent potential data breaches. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-6506

Affected Products

Mrw Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-6506 · Security Note
• https://t.me/cvedetector/53 · Telegram Post
• https://twitter.com/CVEnew/status/1808852620255318085 · Twitter Post
• https://twitter.com/cracbot/status/1810554528590430501 · Twitter Post
• https://twitter.com/cracbot/status/1810192172928651376 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1808886621049143358 · Twitter Post
• https://t.me/cvenotify/85180 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug · Note