The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Metrics
Affected Vendors & Products
References
History
Tue, 17 Sep 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Wp-property-hive
Wp-property-hive propertyhive |
|
CPEs | cpe:2.3:a:wp-property-hive:propertyhive:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Wp-property-hive
Wp-property-hive propertyhive |
|
Metrics |
ssvc
|
Tue, 17 Sep 2024 07:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'save_account_details' function. This makes it possible for unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
Title | PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details | |
Weaknesses | CWE-352 | |
References |
|
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-17T07:33:27.751Z
Updated: 2024-09-17T13:49:22.085Z
Reserved: 2024-09-05T16:56:36.864Z
Link: CVE-2024-8490
Vulnrichment
Updated: 2024-09-17T13:49:12.691Z
NVD
Status : Analyzed
Published: 2024-09-17T08:15:02.227
Modified: 2024-09-27T18:36:00.053
Link: CVE-2024-8490
Redhat
No data.