CVE-2024-7031
published 2024-08-03CVE-2024-7031: The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the…
PriorityP355high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.62%
45.4th percentile
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ninjateam | file_manager_pro_filester | <= 1.8.2 | — |
| ninjateam | filester | < 1.8.3 | 1.8.3 |
| puma | puma | >= 0 < 3.12.4-1ubuntu2+esm2 | 3.12.4-1ubuntu2+esm2 |
| puma | puma | >= 0 < 5.5.2-2ubuntu2+esm2 | 5.5.2-2ubuntu2+esm2 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
puma vulnerability
osv·2024-09-24·CVSS 5.4
CVE-2024-45614 puma vulnerability
puma vulnerability
USN-7031-1 fixed CVE-2024-45614 in Puma for Ubuntu 24.04 LTS.
This update fixes the CVE for Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Puma incorrectly handled parsing certain headers.
A remote attacker could possibly use this issue to overwrite header values
set by intermediate proxies by providing duplicate headers containing
underscore characters.
GHSA
GHSA-fc63-998f-r568: The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_
ghsa_unreviewed·2024-08-03
CVE-2024-7031 [HIGH] CWE-862 GHSA-fc63-998f-r568: The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/FileManager.php#L566https://plugins.trac.wordpress.org/changeset/3129722/https://www.wordfence.com/threat-intel/vulnerabilities/id/aef584bd-60a5-4bf2-b8d3-58e3b45e785e?source=cvehttps://nowotarski.info/wordpress-nonce-authorization/
2024-08-03
Published