CVE-2024-43274 - OpenCVE

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Jshelpdesk	Jshelpdesk

No data.

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve

History

Tue, 05 Nov 2024 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jshelpdesk Jshelpdesk jshelpdesk
CPEs		cpe:2.3:a:jshelpdesk:jshelpdesk::::::wordpress::*
Vendors & Products		Jshelpdesk Jshelpdesk jshelpdesk
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 01 Nov 2024 14:30:00 +0000

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.
Title		WordPress JS Help Desk – The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2024-11-01T14:17:32.655Z

Updated: 2024-11-05T21:37:16.148Z

Reserved: 2024-08-09T09:20:56.506Z

Link: CVE-2024-43274

Vulnrichment

Updated: 2024-11-05T21:37:08.321Z

NVD

Status : Awaiting Analysis

Published: 2024-11-01T15:15:44.710

Modified: 2024-11-01T20:24:53.730

Link: CVE-2024-43274

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43274", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-08-09T09:20:56.506Z", "datePublished": "2024-11-01T14:17:32.655Z", "dateUpdated": "2024-11-05T21:37:16.148Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-11-01T14:17:32.655Z"}, "title": "WordPress JS Help Desk \u2013 The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "JS Help Desk", "product": "JS Help Desk \u2013 Best Help Desk & Support Plugin", "collectionURL": "https://wordpress.org/plugins", "packageName": "js-support-ticket", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "2.8.6", "changes": [{"at": "2.8.7", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in JS Help Desk JS Help Desk \u2013 Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk \u2013 Best Help Desk & Support Plugin: from n/a through 2.8.6.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization vulnerability in JS Help Desk JS Help Desk \u2013 Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects JS Help Desk \u2013 Best Help Desk & Support Plugin: from n/a through 2.8.6.</p>"}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Update to 2.8.7 or a higher version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to 2.8.7 or a higher version."}]}], "credits": [{"lang": "en", "value": "Fariq Fadillah Gusti Insani (Patchstack Alliance)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "jshelpdesk", "product": "jshelpdesk", "cpes": ["cpe:2.3:a:jshelpdesk:jshelpdesk:*:*:*:*:*:wordpress:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.8.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-01T19:05:54.575584Z", "id": "CVE-2024-43274", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T21:37:16.148Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43274", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-01T19:05:54.575584Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jshelpdesk:jshelpdesk:*:*:*:*:*:wordpress:*:*"], "vendor": "jshelpdesk", "product": "jshelpdesk", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.8.6"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T21:37:08.321Z"}}], "cna": {"title": "WordPress JS Help Desk \u2013 The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Fariq Fadillah Gusti Insani (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JS Help Desk", "product": "JS Help Desk \u2013 Best Help Desk & Support Plugin", "versions": [{"status": "affected", "changes": [{"at": "2.8.7", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "2.8.6"}], "packageName": "js-support-ticket", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 2.8.7 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 2.8.7 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in JS Help Desk JS Help Desk \u2013 Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk \u2013 Best Help Desk & Support Plugin: from n/a through 2.8.6.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in JS Help Desk JS Help Desk \u2013 Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.<p>This issue affects JS Help Desk \u2013 Best Help Desk & Support Plugin: from n/a through 2.8.6.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-11-01T14:17:32.655Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43274", "state": "PUBLISHED", "dateUpdated": "2024-11-05T21:37:16.148Z", "dateReserved": "2024-08-09T09:20:56.506Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-11-01T14:17:32.655Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}