exploitDog

CVE-2024-3893

Опубликовано: 25 апр. 2024

Источник: nvd

CVSS3: 5.3

CVSS3: 4.3

EPSS Низкий

Описание

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:radiustheme:classified_listing:*:*:*:*:-:wordpress:*:*

Версия до 3.0.11 (исключая)

EPSS

Процентиль: 24%

0.00081

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-862

Связанные уязвимости

GHSA-6jqm-q264-hgq7

CVSS3: 5.3

github

почти 2 года назад

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.

EPSS

Процентиль: 24%

0.00081

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-862