CVE-2024-4611 Vulnerability Details

  /     /     /  

CVE-2024-4611 Metadata Quick Info

CVE Published: 29/05/2024 | CVE Updated: 01/08/2024 | CVE Year: 2024
Source: Wordfence | Vendor: scottopolis | Product: AppPresser – Mobile App Framework
Status : PUBLISHED

---

CVE-2024-4611 Description

The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the \'decrypt_value\' and on the \'doCookieAuth\' functions in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they previously used the login via the plugin API. This can only be exploited if the \'openssl\' php extension is not loaded on the server.

Metrics

CVSS Version: 3.1 | Base Score: 8.1 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE-703 Improper Check or Handling of Exceptional Conditions
Source: scottopolis

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).