CVE-2024-9990
Crypto <= 2.15 - Cross-Site Request Forgery to Authentication Bypass
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in the 'crypto_connect_ajax_process::check' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
El complemento Crypto para WordPress es vulnerable a Cross-Site Request Forgery en versiones hasta la 2.15 incluida. Esto se debe a la falta de validación de nonce en la función 'crypto_connect_ajax_process::check'. Esto hace posible que atacantes no autenticados inicien sesión como cualquier usuario existente en el sitio, como un administrador a través de una solicitud falsificada, siempre que puedan engañar a un administrador del sitio para que realice una acción como hacer clic en un enlace.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-10-15 CVE Reserved
- 2024-10-28 CVE Published
- 2024-10-30 EPSS Updated
- 2024-11-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (3)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Odude Search vendor "Odude" | Crypto Tool Search vendor "Odude" for product "Crypto Tool" | <= 2.15 Search vendor "Odude" for product "Crypto Tool" and version " <= 2.15" | en |
Affected
| ||||||