Paper/Archive/CVE-2024-2472

CVE-2024-2472

latepoint LatePoint Plugin — LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 49.9.499 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.

Affected

ProductAffectedFixed inSource

LatePoint Plugin≤ 4.9.9–CNA

latepoint_plugin< 4.9.9.14.9.9.1CISA-ADP

Scores by source

Wordfence (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/6215fa9f-06bc-4dc8-b1f5-a3bb75749f1d?source=cve refaramhairchitects.nl refwpdocs.latepoint.com/changelog refwebsec.nl/blog/critical-idor-vulnerability-in-latepoint-plugin-exposes-sensitive-data-666b78446e63d6dcdb0f73bf