All the vulnerabilites related to martinvalchev - Video Gallery for WooCommerce
cve-2024-10535
Vulnerability from cvelistv5
Published
2024-11-06 06:43
Modified
2024-11-06 15:05
Severity ?
EPSS score ?
Summary
The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | martinvalchev | Video Gallery for WooCommerce |
Version: * ≤ 1.31 |
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:martinvalchev:video_gallery_for_woocommerce:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "video_gallery_for_woocommerce", "vendor": "martinvalchev", "versions": [ { "lessThanOrEqual": "1.31", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-10535", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-06T15:02:39.252379Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-06T15:05:15.112Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Video Gallery for WooCommerce", "vendor": "martinvalchev", "versions": [ { "lessThanOrEqual": "1.31", "status": "affected", "version": "*", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "tptNhan" } ], "descriptions": [ { "lang": "en", "value": "The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory." } ], "metrics": [ { "cvssV3_1": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-06T06:43:30.122Z", "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/50259040-a984-42a8-8d58-cc94e349ca45?source=cve" }, { "url": "https://plugins.trac.wordpress.org/browser/video-wc-gallery/trunk/admin/admin-ui-setup.php#L545" }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3182174%40video-wc-gallery\u0026new=3182174%40video-wc-gallery\u0026sfp_email=\u0026sfph_mail=" } ], "timeline": [ { "lang": "en", "time": "2024-11-05T00:00:00.000+00:00", "value": "Disclosed" } ], "title": "Video Gallery for WooCommerce \u003c= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion" } }, "cveMetadata": { "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2024-10535", "datePublished": "2024-11-06T06:43:30.122Z", "dateReserved": "2024-10-30T11:33:59.025Z", "dateUpdated": "2024-11-06T15:05:15.112Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }