CVE-2024-10284: falha crítica em ce21com CE21 Suite
CE21 Suite <= 2.2.0 - Authentication Bypass
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.4%
The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
ce21com · CE21 SuiteCVEs relacionadas — ce21com CE21 Suite
No mesmo produto, das mais perigosas para as menos.
CVE-2024-10285CRITICALCE21 Suite <= 2.2.0 - JWT Token DisclosureEPSS 0.6%CVE-2025-11008CRITICALCE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege EscalationEPSS 0.5%CVE-2025-11007CRITICALCE21 Suite 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via Plugin Settings UpdateEPSS 0.5%CVE-2024-10294MEDIUMCE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings ChangeEPSS 0.3%