fkie_cve-2024-11197
Vulnerability from fkie_nvd
Published
2024-11-21 11:15
Modified
2024-11-21 13:57
Severity ?
Summary
The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, to interact with the vulnerable site via an API such as XML-RPC or REST despite their account being locked.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, to interact with the vulnerable site via an API such as XML-RPC or REST despite their account being locked."
},
{
"lang": "es",
"value": "El complemento Lock User Account para WordPress es vulnerable a la omisi\u00f3n del bloqueo de usuarios en todas las versiones hasta la 1.0.5 incluida. Esto se debe a que permite iniciar sesi\u00f3n con contrase\u00f1a de la aplicaci\u00f3n cuando las cuentas de usuario est\u00e1n bloqueadas. Esto hace posible que los atacantes autenticados, con contrase\u00f1as de aplicaci\u00f3n existentes, interact\u00faen con el sitio vulnerable a trav\u00e9s de una API como XML-RPC o REST a pesar de que su cuenta est\u00e9 bloqueada."
}
],
"id": "CVE-2024-11197",
"lastModified": "2024-11-21T13:57:24.187",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 2.5,
"source": "security@wordfence.com",
"type": "Primary"
}
]
},
"published": "2024-11-21T11:15:24.060",
"references": [
{
"source": "security@wordfence.com",
"url": "https://wordpress.org/plugins/lock-user-account/"
},
{
"source": "security@wordfence.com",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/63374c5c-0b0a-4091-9aee-2e6c1d17a1b2?source=cve"
}
],
"sourceIdentifier": "security@wordfence.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-693"
}
],
"source": "security@wordfence.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…