CVE-2024-1870mediumCWE-862

CVE-2024-1870: falha de média gravidade em extendthemes Colibri Page Builder

Colibri Page Builder <= 1.0.260 - Missing Authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Colibri Page Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260. This makes it possible for authenticated attackers, with subscriber access or higher, to update the license key.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
extendthemes · Colibri Page Builder
CVEs relacionadas — extendthemes Colibri Page Builder

No mesmo produto, das mais perigosas para as menos.

CVE-2023-2188HIGHColibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_idEPSS 0.8%CVE-2024-3340MEDIUMColibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' ShortcodeEPSS 0.4%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2024-3338MEDIUMColibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-3337MEDIUMColibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' ShortcodeEPSS 0.4%CVE-2023-6988MEDIUMColibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%