CVE-2024-37479 - Vulnerability Details - OpenCVE

Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progress_type" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve

History

No history.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2024-07-02T07:40:08.888Z

Updated: 2024-08-02T03:57:39.382Z

Reserved: 2024-06-09T11:43:29.008Z

Link: CVE-2024-37479

Vulnrichment

Updated: 2024-08-02T03:57:39.382Z

NVD

Status : Awaiting Analysis

Published: 2024-07-02T08:15:06.190

Modified: 2024-11-21T09:23:54.570

Link: CVE-2024-37479

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-37479", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-06-09T11:43:29.008Z", "datePublished": "2024-07-02T07:40:08.888Z", "dateUpdated": "2024-08-02T03:57:39.382Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "lastudio-element-kit", "product": "LA-Studio Element Kit for Elementor", "vendor": "LA-Studio", "versions": [{"changes": [{"at": "1.3.9", "status": "unaffected"}], "lessThanOrEqual": "1.3.8.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jo\u00e3o Pedro Soares de Alc\u00e2ntara (Kinorth)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.<p>This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.</p>"}], "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Local File Inclusion", "lang": "en"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-07-02T07:40:08.888Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 1.3.9 or a higher version."}], "value": "Update to 1.3.9 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "la-studioweb", "product": "element_kit_for_elementor", "cpes": ["cpe:2.3:a:la-studioweb:element_kit_for_elementor:1.3.8.1:*:*:*:*:wordpress:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.8.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T14:10:11.487249Z", "id": "CVE-2024-37479", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T14:12:21.439Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.382Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve", "tags": ["vdb-entry", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.382Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-02T14:10:11.487249Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:la-studioweb:element_kit_for_elementor:1.3.8.1:*:*:*:*:wordpress:*:*"], "vendor": "la-studioweb", "product": "element_kit_for_elementor", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.8.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T14:11:58.634Z"}}], "cna": {"title": "WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jo\u00e3o Pedro Soares de Alc\u00e2ntara (Kinorth)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "LA-Studio", "product": "LA-Studio Element Kit for Elementor", "versions": [{"status": "affected", "changes": [{"at": "1.3.9", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.3.8.1"}], "packageName": "lastudio-element-kit", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 1.3.9 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 1.3.9 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.", "supportingMedia": [{"type": "text/html", "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.<p>This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Local File Inclusion"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-07-02T07:40:08.888Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37479", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:57:39.382Z", "dateReserved": "2024-06-09T11:43:29.008Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-07-02T07:40:08.888Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}