CVE-2024-8480

Katalog CVE

CVSS 8.8 · High EPSS 0,85%

Kerentanan Missing Authorization pada sirv. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sirv_save_prevented_sizes' function in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to exploit the 'sirv_upload_file_by_chunks_callback' function, which lacks proper file type validation, allowing attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Rincian

Terbit di NVD

6 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3115018/ patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3e628f-b5e7-40fd-9d34-4a3b23e1e0e7?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.7/sirv.php#L6331 issue tracking
• https://plugins.trac.wordpress.org/browser/sirv/trunk/sirv.php?rev=3103410#L4647 issue tracking