Missing Authorization Vulnerability Affects PilotPress
CVE-2024-23524

8.8HIGH

Key Information:

Vendor

WordPress
Status
Pilotpress
Vendor
CVE Published:
10 June 2024

What is CVE-2024-23524?

The vulnerability in ONTRAPORT Inc. PilotPress is characterized by a missing authorization flaw, which poses a significant security risk. This issue impacts all versions of PilotPress from its inception through 2.0.30. Attackers exploiting this vulnerability could gain unauthorized access to sensitive functionalities within the system, potentially leading to data exposure and manipulation. Organizations using affected versions of PilotPress should prioritize security measures and updates to mitigate risks associated with this vulnerability. Proper access control mechanisms are essential to protect the integrity of user data and maintain system security.

Affected Version(s)

PilotPress <= 2.0.30

References

https://patchstack.com/database/vulnerability/pilotpress/...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
JSON
.