CVE-2024-3591

{"id": "CVE-2024-3591", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2024-05-01T06:15:21.887", "references": [{"url": "https://wpscan.com/vulnerability/f85d8b61-eaeb-433c-b857-06ee4db5c7d5/", "source": "contact@wpscan.com"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog."}, {"lang": "es", "value": "El complemento Geo Controller WordPress anterior a 8.6.5 deserializa la entrada del usuario a trav\u00e9s de algunas de sus acciones AJAX y rutas API REST, lo que podr\u00eda permitir a usuarios no autenticados realizar inyecci\u00f3n de objetos PHP cuando hay un gadget adecuado presente en el blog."}], "lastModified": "2024-07-03T02:06:23.340", "sourceIdentifier": "contact@wpscan.com"}