CVE-2024-9417mediumexplotación observadaCWE-434

CVE-2024-9417: fallo de gravedad media en hashthemes Hash Form – Drag & Drop Form Builder

Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Hash Form – Drag & Drop Form Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

35Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Attendcvss 6.1epss 0.4%
de la publicación al arma
Publicada en NVD5 oct
VulnCheck+738d
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
hashthemes · Hash Form – Drag & Drop Form Builder
CVEs relacionadas — hashthemes Hash Form – Drag & Drop Form Builder

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-5084CRITICALHash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code ExecutionEPSS 50.9%CVE-2024-5085HIGHHash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object InjectionEPSS 0.8%CVE-2024-12201MEDIUMHash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style CreationEPSS 0.4%