The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assistant, and delete_assistant functions. This makes it possible for unauthenticated attackers to modify assistants via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Metrics
Affected Vendors & Products
References
History
Mon, 18 Nov 2024 15:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Kognetiks
Kognetiks kognetiks Chatbot |
|
CPEs | cpe:2.3:a:kognetiks:kognetiks_chatbot:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Kognetiks
Kognetiks kognetiks Chatbot |
Wed, 13 Nov 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 13 Nov 2024 02:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assistant, and delete_assistant functions. This makes it possible for unauthenticated attackers to modify assistants via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
Title | Kognetiks Chatbot for WordPress <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification | |
Weaknesses | CWE-352 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-11-13T02:33:20.521Z
Updated: 2024-11-13T16:25:05.517Z
Reserved: 2024-11-12T14:24:19.624Z
Link: CVE-2024-11143
Vulnrichment
Updated: 2024-11-13T16:24:59.792Z
NVD
Status : Analyzed
Published: 2024-11-13T03:15:05.110
Modified: 2024-11-18T15:03:56.927
Link: CVE-2024-11143
Redhat
No data.