← Retour aux CVEs

CVE-2024-7870

MEDIUM

6.5

Description

The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files.

Details CVE

Score CVSS v3.16.5

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie9/4/2024

Derniere modification10/7/2024

Sourcenvd

Observations honeypot0

Produits affectes

pixelyoursite:pixelyoursite

Faiblesses (CWE)

CWE-287

References

https://github.com/WordpressPluginDirectory/pixelyoursite/blob/main/pixelyoursite/includes/logger/class-pys-logger.php#L126(security@wordfence.com)

https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/includes/class-pys.php#L114(security@wordfence.com)

https://plugins.trac.wordpress.org/changeset/3143047/(security@wordfence.com)

https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd7a515-6389-4152-8dac-d5497dd94f6d?source=cve(security@wordfence.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.