CVE-2024-2429

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 65.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Salonbookingsystem Salon Booking SystemUnknown Salon Booking System
Timeline
PublishedApr 26

Description

The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-jjv2-293m-3wrf: The Salon booking system WordPress plugin through 9↗2024-04-26
▶
CVEList
Salon booking system <= 9.6.5 - Settings Update via CSRF↗2024-04-26
▶
CVE-2024-2429 (MEDIUM CVSS 4.3) | The Salon booking system WordPress | cvebase.io