Missing Authorization Vulnerability Affects PilotPress
CVE-2024-23524

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Pilotpress
Vendor
CVE Published:
10 June 2024

What is CVE-2024-23524?

The vulnerability in ONTRAPORT Inc. PilotPress is characterized by a missing authorization flaw, which poses a significant security risk. This issue impacts all versions of PilotPress from its inception through 2.0.30. Attackers exploiting this vulnerability could gain unauthorized access to sensitive functionalities within the system, potentially leading to data exposure and manipulation. Organizations using affected versions of PilotPress should prioritize security measures and updates to mitigate risks associated with this vulnerability. Proper access control mechanisms are essential to protect the integrity of user data and maintain system security.

Affected Version(s)

PilotPress <= 2.0.30

References

https://patchstack.com/database/vulnerability/pilotpress/...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.