CVE-2024-8242mediumCWE-434

CVE-2024-8242: medium-severity vulnerability in inspireui MStore API – Create Native Android &…

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor MStore API – Create Native Android & iOS Apps On The Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.8%
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
inspireui · MStore API – Create Native Android & iOS Apps On The Cloud
Related CVEs — inspireui MStore API – Create Native Android &…

In the same product, most dangerous first.

CVE-2023-2732CRITICALMStore API <= 3.9.2 - Authentication BypassEPSS 67.3%CVE-2023-3197CRITICALMStore API <= 4.0.1 - Unauthenticated SQL InjectionEPSS 3.9%CVE-2023-2734CRITICALMStore API <= 3.9.1 - Authentication BypassEPSS 3.8%CVE-2023-3277CRITICALMStore API <= 4.10.7 - Unauthorized Account Access and Privilege EscalationEPSS 3.4%CVE-2020-36713CRITICALMStore API <= 2.1.5 - Authentication BypassEPSS 1.6%CVE-2023-2733CRITICALMStore API <= 3.9.0 - Authentication BypassEPSS 1.2%