CVE-2024-7432
Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.8EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
01 oct 2024Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
ultrapressorg · Unseen Blog¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →