CVE-2024-8490
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary
The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This vulnerability is due to missing or incorrect nonce validation on the 'save_account_details' function. It allows unauthenticated attackers to edit the name, email address, and password of an administrator account via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Impact
This vulnerability can have severe consequences. Attackers can potentially gain unauthorized access to administrator accounts by changing their credentials. This could lead to complete compromise of the WordPress site, including: 1. Unauthorized access to sensitive information 2. Modification or deletion of website content 3. Installation of malicious plugins or themes 4. Use of the compromised site for further attacks or malicious activities 5. Potential damage to the organization's reputation The attack requires user interaction (such as clicking a malicious link), which slightly reduces the ease of exploitation but still poses a significant risk, especially if targeted at administrators. The CVSS base score for this vulnerability is 6.5, indicating a medium to high severity.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects "all versions up to, and including, 2.0.19" of the PropertyHive plugin, it is likely that a patched version (2.0.20 or later) may be available or in development. The security team should check for updates to the PropertyHive plugin and apply them as soon as they become available.
Mitigation
Until a patch is available, consider the following mitigation strategies: 1. Temporarily disable the PropertyHive plugin if it's not critical for operations. 2. Implement strong Content Security Policies (CSP) to prevent unauthorized script execution. 3. Educate administrators about the risks of clicking on unknown links, especially when logged into the WordPress dashboard. 4. Use Web Application Firewalls (WAF) to help detect and block CSRF attempts. 5. Implement additional authentication measures for critical account changes, such as requiring password re-entry or two-factor authentication. 6. Regularly monitor administrator account activities for any suspicious changes. 7. Consider using a plugin that enforces proper nonce validation across the WordPress site. Given the medium to high severity of this vulnerability (CVSS score 6.5), prioritize these mitigations and be prepared to apply the patch immediately when it becomes available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Timeline
Feedly found the first article mentioning CVE-2024-8490. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-8490
A CVSS base score of 8.8 has been assigned.
Detection for the vulnerability has been added to Qualys (152209)
EPSS Score was set to: 0.05% (Percentile: 22.7%)
A CVSS base score of 6.5 has been assigned.