CVE-2024-39650 - OpenCVE

Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce PDF Vouchers: from n/a through 4.9.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Wpweb	Woocommerce Pdf Vouchers

No data.

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/woocommerce-pdf-vouchers/wordpress-woocommerce-pdf-vouchers-plugin-4-9-3-unauthenticated-multiple-vulnerabilities?_s_id=cve

History

Fri, 01 Nov 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wpweb Wpweb woocommerce Pdf Vouchers
CPEs		cpe:2.3:a:wpweb:woocommerce_pdf_vouchers::::::::
Vendors & Products		Wpweb Wpweb woocommerce Pdf Vouchers
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 01 Nov 2024 14:30:00 +0000

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce PDF Vouchers: from n/a through 4.9.4.
Title		WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Multiple Vulnerabilities
Weaknesses		CWE-862
References		https://patchstack.com/database/vulnerability/woocommerce-pdf-vouchers/wordpress-woocommerce-pdf-vouchers-plugin-4-9-3-unauthenticated-multiple-vulnerabilities?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2024-11-01T14:17:52.424Z

Updated: 2024-11-01T18:44:01.576Z

Reserved: 2024-06-26T21:19:06.154Z

Link: CVE-2024-39650

Vulnrichment

Updated: 2024-11-01T18:43:57.157Z

NVD

Status : Awaiting Analysis

Published: 2024-11-01T15:15:37.117

Modified: 2024-11-01T20:24:53.730

Link: CVE-2024-39650

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39650", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-06-26T21:19:06.154Z", "datePublished": "2024-11-01T14:17:52.424Z", "dateUpdated": "2024-11-01T18:44:01.576Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-11-01T14:17:52.424Z"}, "title": "WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Multiple Vulnerabilities", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "WPWeb Elite", "product": "WooCommerce PDF Vouchers", "packageName": "woocommerce-pdf-vouchers", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "4.9.4", "changes": [{"at": "4.9.5", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce PDF Vouchers: from n/a through\u00a04.9.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects WooCommerce PDF Vouchers: from n/a through 4.9.4.</p>"}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/woocommerce-pdf-vouchers/wordpress-woocommerce-pdf-vouchers-plugin-4-9-3-unauthenticated-multiple-vulnerabilities?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "Update to 4.9.5 or a higher version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to 4.9.5 or a higher version."}]}], "credits": [{"lang": "en", "value": "Dave Jong (Patchstack)", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "wpweb", "product": "woocommerce_pdf_vouchers", "cpes": ["cpe:2.3:a:wpweb:woocommerce_pdf_vouchers:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.9.4", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-01T18:41:20.577314Z", "id": "CVE-2024-39650", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T18:44:01.576Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-01T18:41:20.577314Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wpweb:woocommerce_pdf_vouchers:*:*:*:*:*:*:*:*"], "vendor": "wpweb", "product": "woocommerce_pdf_vouchers", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.9.4"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T18:43:57.157Z"}}], "cna": {"title": "WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Multiple Vulnerabilities", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Dave Jong (Patchstack)"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WPWeb Elite", "product": "WooCommerce PDF Vouchers", "versions": [{"status": "affected", "changes": [{"at": "4.9.5", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "4.9.4"}], "packageName": "woocommerce-pdf-vouchers", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 4.9.5 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 4.9.5 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/woocommerce-pdf-vouchers/wordpress-woocommerce-pdf-vouchers-plugin-4-9-3-unauthenticated-multiple-vulnerabilities?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce PDF Vouchers: from n/a through\u00a04.9.4.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects WooCommerce PDF Vouchers: from n/a through 4.9.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-11-01T14:17:52.424Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39650", "state": "PUBLISHED", "dateUpdated": "2024-11-01T18:44:01.576Z", "dateReserved": "2024-06-26T21:19:06.154Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-11-01T14:17:52.424Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}