CVE-2024-11917: fallo de gravedad alta en eyecix JobSearch WP Job Board
JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.5%
The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper configurations in the 'jobsearch_xing_response_data_callback', 'set_access_tokes', and 'google_callback' functions. This makes it possible for unauthenticated attackers to log in as the first connected Xing user, or any connected Xing user if the Xing id is known. It is also possible for unauthenticated attackers to log in as the first connected Google user if the user has logged in, without subsequently logging out, in thirty days. The vulnerability was partially patched in version 2.8.4.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
eyecix · JobSearch WP Job BoardCVEs relacionadas — eyecix JobSearch WP Job Board
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-4361HIGHJobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options UpdateEPSS 1.2%CVE-2024-8615CRITICALWP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2021-4352MEDIUMJobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings ChangeEPSS 0.8%CVE-2024-8614CRITICALWP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.8%CVE-2021-4364MEDIUMJobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() functionEPSS 0.7%CVE-2024-11925CRITICALWP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege EscalationEPSS 0.7%