CVE-2024-10174highCWE-639

CVE-2024-10174: falha de alta gravidade em wedevs Project Manager – AI Powered Project…

WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 0.7%
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'Abstract_Permission' class due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to spoof their identity to that of an administrator and access all of the plugins REST routes.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
wedevs · Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
CVEs relacionadas — wedevs Project Manager – AI Powered Project…

No mesmo produto, das mais perigosas para as menos.

CVE-2023-3636HIGHWP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2026-116512CRITICALProject Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function InjectionEPSS 0.6%CVE-2024-13752MEDIUMWP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options UpdateEPSS 0.5%CVE-2024-12195MEDIUMWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2020-36745MEDIUMWP Project Manager <= 2.4.0 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2024-13500MEDIUMWP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby ParameterEPSS 0.4%