CVE-2024-3112

Published Jul 12, 2024

Last updated 3 months ago

CVSS medium 4.8

Overview

Description: The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.8
Impact score: 2.7
Exploitability score: 1.7
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:bestwebsoft:quotes_and_tips:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7831352E-3339-4DB8-8708-F4DE6930CFD4",
            "versionEndExcluding": "1.45"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References