CVE-2024-9307

The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file or upload arbitrary EXE files on the affected site's server which may make remote code execution possible if the attacker can also gain access to run the .exe file, or trick a site visitor into downloading and running the .exe file.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://wordpress.org/plugins/mfolio-lite/#developers	Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/3b4012dd-7c0a-45f1-8ada-8f9dc6867e1e?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:themelooks:mfolio:*:*:*:*:lite:wordpress:*:*

History

No history.

Information

Published : 2024-11-06 07:15

Updated : 2024-11-08 21:18

NVD link : CVE-2024-9307

Mitre link : CVE-2024-9307

CVE.ORG link : CVE-2024-9307

JSON object : View

Products Affected

themelooks

mfolio

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2024-9307", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-11-06T07:15:04.717", "references": [{"url": "https://wordpress.org/plugins/mfolio-lite/#developers", "tags": ["Release Notes"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3b4012dd-7c0a-45f1-8ada-8f9dc6867e1e?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file or upload arbitrary EXE files on the affected site's server which may make remote code execution possible if the attacker can also gain access to run the .exe file, or trick a site visitor into downloading and running the .exe file."}, {"lang": "es", "value": "El complemento mFolio Lite para WordPress es vulnerable a las cargas de archivos debido a la falta de una comprobaci\u00f3n de capacidad en todas las versiones hasta la 1.2.1 incluida. Esto permite que atacantes autenticados, con acceso de nivel de autor o superior, inyecten scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n siempre que un usuario acceda al archivo SVG o cargue archivos EXE arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo si el atacante tambi\u00e9n puede obtener acceso para ejecutar el archivo .exe o enga\u00f1ar a un visitante del sitio para que descargue y ejecute el archivo .exe."}], "lastModified": "2024-11-08T21:18:16.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:themelooks:mfolio:*:*:*:*:lite:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "6900B9BF-BA00-426A-B1B2-C59A41EC6CD3", "versionEndIncluding": "1.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}