CVE-2024-12145: fallo de gravedad media en BuddyPress
BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.3%
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
buddypress · BuddyPressCVEs relacionadas — BuddyPress
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-21389HIGHBuddyPress privilege escalation via REST APIEPSS 14.8%CVE-2020-5244HIGHPrivate data exposure via REST API in BuddyPressEPSS 2.4%CVE-2026-1360HIGHBuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field DataEPSS 1.2%CVE-2024-10011HIGHBuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory TraversalEPSS 1.2%CVE-2024-11976HIGHBuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.6%CVE-2024-3974MEDIUMBuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%