PT-2024-39493 · WordPress · Full – Cliente Plugin

Dale Mavers + 1 · Published 2024-10-11 · Updated 2024-10-15 · CVE-2024-9211

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FULL – Cliente plugin for WordPress versions up to, and including, 3.1.22

Description The issue allows unauthenticated attackers to inject arbitrary web scripts in pages through Reflected Cross-Site Scripting. This is possible due to the use of add query arg and remove query arg without proper escaping on the URL. Attackers can exploit this by tricking a user into performing an action, such as clicking on a link.

Recommendations For versions up to, and including, 3.1.22, update to a version later than 3.1.22 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9211

Affected Products

Full – Cliente Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-9211 · Security Note
• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.22/app/views/admin/connection.php#L110 · Note
• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.23/app/views/admin/config.php#L274 · Note
• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.22/app/views/admin/templates/endpoints/cloud.php#L7 · Note
• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.22/app/views/admin/config.php#L274 · Note
• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.23/app/views/admin/templates/endpoints/cloud.php#L7 · Note
• https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.23/app/views/admin/connection.php#L110 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f62a486a-137b-48e5-b276-44438958e811?source=cve · Note