OpenCVE

The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Creativemindssolutions	Cm-table-of-content

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130/

History

Mon, 18 Nov 2024 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Creativemindssolutions Creativemindssolutions cm-table-of-content
CPEs		cpe:2.3:a:creativemindssolutions:cm-table-of-content::::::wordpress::*
Vendors & Products		Creativemindssolutions Creativemindssolutions cm-table-of-content
Metrics		cvssV3_1 `{'score': 3.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 18 Nov 2024 06:15:00 +0000

Type	Values Removed	Values Added
Description		The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Title		CM Table Of Contents – WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF
References		https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-11-18T06:00:01.043Z

Updated: 2024-11-18T13:57:03.418Z

Reserved: 2024-05-16T19:44:17.915Z

Link: CVE-2024-5030

Vulnrichment

Updated: 2024-11-18T13:54:06.397Z

NVD

Status : Awaiting Analysis

Published: 2024-11-18T06:15:06.593

Modified: 2024-11-18T17:11:17.393

Link: CVE-2024-5030

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5030", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-05-16T19:44:17.915Z", "datePublished": "2024-11-18T06:00:01.043Z", "dateUpdated": "2024-11-18T13:57:03.418Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-11-18T06:00:01.043Z"}, "title": "CM Table Of Contents \u2013 WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF", "problemTypes": [{"descriptions": [{"description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "CM Table Of Contents", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.2.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack"}], "references": [{"url": "https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Felipe Caon", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"affected": [{"vendor": "creativemindssolutions", "product": "cm-table-of-content", "cpes": ["cpe:2.3:a:creativemindssolutions:cm-table-of-content:*:*:*:*:*:wordpress:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "1.2.3", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-18T13:54:31.244244Z", "id": "CVE-2024-5030", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T13:57:03.418Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-5030", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-18T13:54:31.244244Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:creativemindssolutions:cm-table-of-content:*:*:*:*:*:wordpress:*:*"], "vendor": "creativemindssolutions", "product": "cm-table-of-content", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T13:54:06.397Z"}}], "cna": {"title": "CM Table Of Contents \u2013 WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Felipe Caon"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "CM Table Of Contents", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-11-18T06:00:01.043Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5030", "state": "PUBLISHED", "dateUpdated": "2024-11-18T13:57:03.418Z", "dateReserved": "2024-05-16T19:44:17.915Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2024-11-18T06:00:01.043Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}