CVE-2024-2472criticalCWE-639

CVE-2024-2472: fallo crítico en LatePoint Plugin

LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LatePoint Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.6%
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
latepoint · LatePoint Plugin
CVEs relacionadas — LatePoint Plugin

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-8943CRITICALLatePoint <= 5.0.12 - Authentication BypassEPSS 3.1%CVE-2024-8911CRITICALLatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL InjectionEPSS 2.9%