PT-2024-39043 · Brevo · The Newsletter

Joshua Chan · Published 2024-10-09 · Updated 2024-10-15 · CVE-2024-8477

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo plugin for WordPress versions up to, and including, 3.1.87

Description: The issue is due to missing or incorrect nonce validation on the Init() function, making it possible for unauthenticated attackers to log out of a Brevo connection via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link.

Recommendations: For versions up to, and including, 3.1.87, update to a version that includes the fix for the missing or incorrect nonce validation on the Init() function. As a temporary workaround, consider restricting access to the Init() function until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-8477

Affected Products

The Newsletter

References · 8

• https://plugins.trac.wordpress.org/changeset/3165451/mailin/tags/3.1.88/page/page-home.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8477 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8477 · Vendor Advisory
• https://t.me/cvenotify/98061 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e070b422-9036-4362-832b-43fd4838f394?source=cve · Note
• https://twitter.com/CVEnew/status/1844204381413024124 · Twitter Post
• https://t.me/cvenotify/97713 · Telegram Post
• https://t.me/cvedetector/7562 · Telegram Post