Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for cliengo-chatbot by cliengo

    CVE-2024-5992 (GCVE-0-2024-5992)

    Vulnerability from nvd – Published: 2024-07-09 08:33 – Updated: 2026-04-08 17:13
    VLAI
    Title
    Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update
    Summary
    The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' and 'update_chatbot_position' functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-07-09 13:58 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    cliengo Cliengo – Chatbot Affected: 0 , ≤ 3.0.2 (semver)
    		Create a notification for this product.
    cliengo cliengo-chatbot Affected: 0 , ≤ 3.0.1 (semver)
        cpe:2.3:a:cliengo:cliengo-chatbot:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Lucio Sá
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cliengo:cliengo-chatbot:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cliengo-chatbot",
            "vendor": "cliengo",
            "versions": [
              {
                "lessThanOrEqual": "3.0.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T13:58:31.145858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-10T19:41:21.234Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:25:03.186Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L99"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cliengo \u2013 Chatbot",
          "vendor": "cliengo",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lucio S\u00e1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cliengo \u2013 Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027update_chatbot_token\u0027 and \u0027update_chatbot_position\u0027 functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:13:47.199Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3118688/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-08T19:56:10.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Cliengo - Chatbot \u003c= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-5992",
    "datePublished": "2024-07-09T08:33:10.073Z",
    "dateReserved": "2024-06-13T21:55:11.318Z",
    "dateUpdated": "2026-04-08T17:13:47.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-5992 (GCVE-0-2024-5992)

    Vulnerability from cvelistv5 – Published: 2024-07-09 08:33 – Updated: 2026-04-08 17:13
    VLAI
    Title
    Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update
    Summary
    The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' and 'update_chatbot_position' functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-07-09 13:58 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    cliengo Cliengo – Chatbot Affected: 0 , ≤ 3.0.2 (semver)
    		Create a notification for this product.
    cliengo cliengo-chatbot Affected: 0 , ≤ 3.0.1 (semver)
        cpe:2.3:a:cliengo:cliengo-chatbot:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Lucio Sá
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cliengo:cliengo-chatbot:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cliengo-chatbot",
            "vendor": "cliengo",
            "versions": [
              {
                "lessThanOrEqual": "3.0.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T13:58:31.145858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-10T19:41:21.234Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:25:03.186Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L99"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cliengo \u2013 Chatbot",
          "vendor": "cliengo",
          "versions": [
            {
              "lessThanOrEqual": "3.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lucio S\u00e1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cliengo \u2013 Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027update_chatbot_token\u0027 and \u0027update_chatbot_position\u0027 functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:13:47.199Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3118688/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-08T19:56:10.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Cliengo - Chatbot \u003c= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-5992",
    "datePublished": "2024-07-09T08:33:10.073Z",
    "dateReserved": "2024-06-13T21:55:11.318Z",
    "dateUpdated": "2026-04-08T17:13:47.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}