by Kastro
Paper/Archive/CVE-2024-31380

CVE-2024-31380

Soflyy Oxygen Builder — WordPress Oxygen plugin <= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability

EPSS 0.8%CVSS 9.9
critical.is priorityof 100
41
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 55.1.551 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9.

Affected

ProductAffectedFixed inSource
Oxygen Buildern/a – 4.9–CNA
oxygen≤ 4.8.2–CISA-ADP

Scores by source

Patchstack (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refpatchstack.com/database/vulnerability/oxygen/wordpress-oxygen-plugin-4-8-1-auth-remote-code-execution-rce-vulnerability?_s_id=cvewriteupsnicco.io/vulnerability-disclosure/oxygen/client-control-remote-code-execution-oxygen-4-8-1