CVE-2024-1362: fallo de gravedad media en extendthemes Colibri Page Builder
Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.2%
The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing or incorrect nonce validation on the cp_shortcode_refresh() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
extendthemes · Colibri Page BuilderCVEs relacionadas — extendthemes Colibri Page Builder
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-2188HIGHColibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_idEPSS 0.8%CVE-2024-3340MEDIUMColibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' ShortcodeEPSS 0.4%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2024-3338MEDIUMColibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-3337MEDIUMColibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' ShortcodeEPSS 0.4%CVE-2024-1870MEDIUMColibri Page Builder <= 1.0.260 - Missing AuthorizationEPSS 0.4%