CVE-2024-4874

The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify posts and pages created by other users including admins. As a requirement for this, an admin would have to enable access to the editor specifically for such a user or enable it for all users with a certain user account type.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bricksbuilder.io/release/bricks-1-9-9/#access-control-fix-for-user-role-contributor	Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d63e898-43e5-42b5-96b6-1453352e0cae?source=cve	Third Party Advisory
https://bricksbuilder.io/release/bricks-1-9-9/#access-control-fix-for-user-role-contributor	Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d63e898-43e5-42b5-96b6-1453352e0cae?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bricksbuilder:bricks:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-06-22 05:15

Updated : 2024-11-21 09:43

NVD link : CVE-2024-4874

Mitre link : CVE-2024-4874

CVE.ORG link : CVE-2024-4874

JSON object : View

Products Affected

bricksbuilder

bricks

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2024-4874", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-06-22T05:15:11.837", "references": [{"url": "https://bricksbuilder.io/release/bricks-1-9-9/#access-control-fix-for-user-role-contributor", "tags": ["Release Notes"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d63e898-43e5-42b5-96b6-1453352e0cae?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://bricksbuilder.io/release/bricks-1-9-9/#access-control-fix-for-user-role-contributor", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d63e898-43e5-42b5-96b6-1453352e0cae?source=cve", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify posts and pages created by other users including admins. As a requirement for this, an admin would have to enable access to the editor specifically for such a user or enable it for all users with a certain user account type."}, {"lang": "es", "value": "El complemento Bricks Builder para WordPress es vulnerable a Insecure Direct Object Reference en todas las versiones hasta la 1.9.8 incluida a trav\u00e9s del par\u00e1metro postId debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, modifiquen publicaciones y p\u00e1ginas creadas por otros usuarios, incluidos los administradores. Como requisito para esto, un administrador tendr\u00eda que habilitar el acceso al editor espec\u00edficamente para dicho usuario o habilitarlo para todos los usuarios con un determinado tipo de cuenta de usuario."}], "lastModified": "2024-11-21T09:43:46.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bricksbuilder:bricks:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "07E03076-E07E-4943-A79F-E3FD5CE283E0", "versionEndExcluding": "1.9.9"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}