CVE-2024-4186: fallo crítico en wisdmlabs Edwiser Bridge – WordPress Moodle…
Edwiser Bridge <= 3.0.5 - Authentication Bypass due to Missing Empty Value Check
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.9%
The Edwiser Bridge plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.5. This is due to the 'eb_user_email_verification_key' default value is empty, and the not empty check is missing in the 'eb_user_email_verify' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This can only be exploited if the 'Email Verification' setting is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
wisdmlabs · Edwiser Bridge – WordPress Moodle IntegrationCVEs relacionadas — wisdmlabs Edwiser Bridge – WordPress Moodle…
En el mismo producto, de las más peligrosas a las menos.