CVE-2024-35717 - OpenCVE

Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Awplife	Media Slider

Configuration 1 [-]

cpe:2.3:a:awplife:media_slider:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/media-slider/wordpress-media-slider-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve

History

Wed, 25 Sep 2024 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Awplife Awplife media Slider
CPEs		cpe:2.3:a:awplife:media_slider::::::wordpress::*
Vendors & Products		Awplife Awplife media Slider

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2024-06-10T08:00:31.525Z

Updated: 2024-08-02T03:14:53.933Z

Reserved: 2024-05-17T10:09:21.575Z

Link: CVE-2024-35717

Vulnrichment

Updated: 2024-07-12T19:31:58.037Z

NVD

Status : Analyzed

Published: 2024-06-10T08:15:48.723

Modified: 2024-09-25T14:46:17.400

Link: CVE-2024-35717

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35717", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-05-17T10:09:21.575Z", "datePublished": "2024-06-10T08:00:31.525Z", "dateUpdated": "2024-08-02T03:14:53.933Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "media-slider", "product": "Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow", "vendor": "A WP Life", "versions": [{"changes": [{"at": "1.4.0", "status": "unaffected"}], "lessThanOrEqual": "1.3.9", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Steven Julian (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in A WP Life Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.<p>This issue affects Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.</p>"}], "value": "Missing Authorization vulnerability in A WP Life Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-06-10T08:00:31.525Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/media-slider/wordpress-media-slider-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 1.4.0 or a higher version."}], "value": "Update to 1.4.0 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Media Slider plugin <= 1.3.9 - Broken Access Control vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-12T19:31:51.796115Z", "id": "CVE-2024-35717", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T19:32:09.300Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:14:53.933Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/media-slider/wordpress-media-slider-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35717", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-12T19:31:51.796115Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T19:31:58.037Z"}}], "cna": {"title": "WordPress Media Slider plugin <= 1.3.9 - Broken Access Control vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Steven Julian (Patchstack Alliance)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "A WP Life", "product": "Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow", "versions": [{"status": "affected", "changes": [{"at": "1.4.0", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.3.9"}], "packageName": "media-slider", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 1.4.0 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 1.4.0 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/media-slider/wordpress-media-slider-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in A WP Life Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in A WP Life Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.<p>This issue affects Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-06-10T08:00:31.525Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35717", "state": "PUBLISHED", "dateUpdated": "2024-07-12T19:32:09.300Z", "dateReserved": "2024-05-17T10:09:21.575Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-06-10T08:00:31.525Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:awplife:media_slider:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "E8C08C28-B557-48F9-A212-CC679F91DAF9", "versionEndExcluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in A WP Life Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en A WP Life Media Slider: Photo Sleder, Video Slider, Link Slider, Carousal Slideshow. Este problema afecta a Media Slider: Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: desde n/a hasta 1.3.9."}], "id": "CVE-2024-35717", "lastModified": "2024-09-25T14:46:17.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2024-06-10T08:15:48.723", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/media-slider/wordpress-media-slider-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}