CVE-2024-7863

Published Sep 13, 2024

Last updated 2 months ago

CVSS medium 6.8

Overview

Description: The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.8
Impact score: 5.9
Exploitability score: 0.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:pixeljar:favicon_generator:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD25634F-DF77-4192-AFC0-70242B138177",
            "versionEndExcluding": "2.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References