Description

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the start_or_use_session_for_customer function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customers cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.

Classification

Assigner:

CWE:

Links
CPEs
  • latepoint latepoint_plugin 4.9.9

CVSS

CVSS version: 3.1 Base score: 9.1
Base severity: CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability score: 3.9 Impact score: 5.2

Can you explain the CVE description?

This CVE description is for a vulnerability identified as CVE-2024-2472 in the LatePoint Plugin plugin for WordPress. The vulnerability allows unauthorized access to data and modification of data due to a missing capability check on the start_or_use_session_for_customer function in all versions up to and including 4.9.9. This flaw enables unauthenticated attackers to view other customers cabinets, including potentially sensitive information such as email addresses, and to change their LatePoint user password, which may or may not be associated with a WordPress account. The CVSS score for this vulnerability is 9.1, indicating a critical severity level. The vulnerability was published on June 14, 2024, and is currently in the EARLY_WARNING status. The exploitability score is 3.9, and the impact score is 5.2. The vector CVSS for this vulnerability is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Additional information and resources related to this vulnerability can be found in the provided URLs.

How can this vulnerability be part of an attack tree?

This vulnerability can be part of an attack tree by allowing attackers to gain unauthorized access to sensitive data and manipulate it, potentially leading to further exploitation. Here is how it can be included in an attack tree: 1. Initial Access: - Attacker exploits the missing capability check vulnerability in the LatePoint Plugin plugin for WordPress (CVE-2024-2472) to gain unauthorized access to customer data. 2. Privilege Escalation: - With access to sensitive information such as email addresses and the ability to change user passwords, the attacker can escalate their privileges within the system. 3. Data Exfiltration: - The attacker can exfiltrate personally identifiable information (PII) from customer cabinets, potentially leading to identity theft or other malicious activities. 4. Account Takeover: - By changing LatePoint user passwords, the attacker may gain control of customer accounts associated with WordPress, allowing for further unauthorized actions. 5. Persistence: - The attacker could maintain access to the system by creating backdoors or exploiting other vulnerabilities, leading to continued unauthorized access and potential data breaches.


Generated on: 2024-07-01