by Kastro
Paper/Archive/CVE-2024-7568

CVE-2024-7568

brandondove Favicon Generator (CLOSED) — Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion

EPSS 0.3%CVSS 9.6
critical.is priorityof 100
33
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 18.5.185 × 203.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin. CVE-2024-7864 appears to be a duplicate of this issue.

Affected

ProductAffectedFixed inSource
Favicon Generator (CLOSED)≤ 1.5–CNA

Scores by source

Wordfence (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refwordfence.com/threat-intel/vulnerabilities/id/6eb3ad80-3510-4018-91af-b733ef62e28f?source=cverefplugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3139340%40favicon-generator&new=3139340%40favicon-generator&sfp_email=&sfph_mail=