by Kastro
Paper/Archive/CVE-2024-12583

CVE-2024-12583

alexacrm Dynamics 365 Integration — Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

EPSS 1%CVSS 9.9
critical.is priorityof 100
44
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 72.2.722 × 2014.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affected

ProductAffectedFixed inSource
Dynamics 365 Integration≤ 1.3.23–CNA

Scores by source

Wordfence (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/7f3dac5a-9ff8-4e8c-8c73-422123e121d8?source=cverefplugins.trac.wordpress.org/browser/integration-dynamics/trunk/src/Shortcode/Twig.php#L53refplugins.trac.wordpress.org/changeset/3210927