CVE-2024-4474 — Cross-Site Request Forgery in WP Logs Book

CWE-352 — Cross-Site Request Forgery9 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
2.8%
top 13.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Onetarek WP Logs Book
Timeline
PublishedJun 21

Description

The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-mw3g-56pg-c72p: The WP Logs Book WordPress plugin through 1↗2024-06-21
▶
CVEList
WP Logs Book <= 1.0.1 - Disable Logging via CSRF↗2024-06-21
▶

🔍Detection Rules

6
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M6↗2024-05-02
▶
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M2↗2024-05-02
▶
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M3↗2024-05-02
▶
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M1↗2024-05-02
▶
Suricata
ET WEB_SPECIFIC_APPS Zyxel Command Injection Attempt (CVE-2024-4474) M5↗2024-05-02
▶
CVE-2024-4474 — Cross-Site Request Forgery | cvebase