CVE-2024-9417mediumexploração observadaCWE-434

CVE-2024-9417: falha de média gravidade em hashthemes Hash Form – Drag & Drop Form Builder

Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Hash Form – Drag & Drop Form Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

35Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Attendcvss 6.1epss 0.4%
da publicação à arma
Publicada no NVD5 de out.
VulnCheck+738d
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
hashthemes · Hash Form – Drag & Drop Form Builder
CVEs relacionadas — hashthemes Hash Form – Drag & Drop Form Builder

No mesmo produto, das mais perigosas para as menos.

CVE-2024-5084CRITICALHash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code ExecutionEPSS 50.9%CVE-2024-5085HIGHHash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object InjectionEPSS 0.8%CVE-2024-12201MEDIUMHash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style CreationEPSS 0.4%