CVE-2024-9634

Deserialization of Untrusted Data (CWE-502)

Published: Oct 16, 2024 / Updated: 35d ago

010
CVSS 9.8EPSS 0.06%Critical
CVE info copied to clipboard

Summary

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3. This vulnerability is due to the deserialization of untrusted input from the give_company_name parameter. It allows unauthenticated attackers to inject a PHP Object, which, combined with the presence of a POP chain, can lead to remote code execution.

Impact

This vulnerability has a severe impact on affected WordPress installations using the GiveWP plugin. Unauthenticated attackers can potentially execute arbitrary code remotely on the target system. This could lead to complete compromise of the affected WordPress site, including unauthorized access to sensitive data, modification of website content, and potential use of the compromised site as a pivot point for further attacks. The vulnerability affects the confidentiality, integrity, and availability of the system, all rated as "HIGH" impact according to the CVSS score.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided data. However, given that the vulnerability affects "all versions up to, and including, 3.16.3" of the GiveWP plugin, it is likely that a patched version (3.16.4 or later) has been or will be released to address this vulnerability. Users should check for and apply the latest update as soon as it becomes available.

Mitigation

1. Update the GiveWP plugin to a version newer than 3.16.3 as soon as a patched version is available. 2. If an immediate update is not possible, consider temporarily disabling the GiveWP plugin until it can be updated. 3. Implement strong input validation and sanitization for the 'give_company_name' parameter to prevent deserialization of untrusted data. 4. Use Web Application Firewall (WAF) rules to filter out potentially malicious inputs targeting this vulnerability. 5. Monitor WordPress and plugin logs for any suspicious activity related to the GiveWP plugin. 6. Regularly update all WordPress plugins, themes, and core installations to minimize exposure to known vulnerabilities.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9634. See article

Oct 16, 2024 at 1:55 AM / Cybersecurity News
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 16, 2024 at 1:55 AM
CVE Assignment

NVD published the first details for CVE-2024-9634

Oct 16, 2024 at 2:15 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 16, 2024 at 2:20 AM / nvd
EPSS

EPSS Score was set to: 0.06% (Percentile: 28.3%)

Oct 16, 2024 at 9:58 AM
Threat Intelligence Report

CVE-2024-9634 is a critical PHP Object Injection vulnerability in the GiveWP Donation Plugin, with a CVSS score of 9.8, affecting all versions up to and including 3.16.3. To mitigate this vulnerability, it is strongly recommended that all websites using the affected plugin update to version 3.16.4 or later. There is no information provided regarding exploitation in the wild, proof-of-concept exploits, or downstream impacts on other third-party vendors or technology. See article

Oct 16, 2024 at 11:07 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (731845)

Oct 17, 2024 at 7:15 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (152311)

Oct 17, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Wordpress/wordpress
+null more

Attack Patterns

CAPEC-586: Object Injection
+null more

References

Critical Vulnerabilities Affecting GitHub Enterprise Server, Kubernetes Image Builder, and GiveWP Plugin
Recently, several critical vulnerabilities have been disclosed, affecting widely used platforms like GitHub Enterprise Server (GHES), Kubernetes Image Builder, and the GiveWP plugin for WordPress. The latest security update for GitHub Enterprise Server (GHES) addresses three newly discovered vulnerabilities, including a critical issue that could allow unauthorized access to the platform.
Critical Vulnerabilities Affecting GitHub Enterprise Server, Kubernetes Image Builder, and GiveWP Plugin
Recently, several critical vulnerabilities have been disclosed, affecting widely used platforms like GitHub Enterprise Server (GHES), Kubernetes Image Builder, and the GiveWP plugin for WordPress. The latest security update for GitHub Enterprise Server (GHES) addresses three newly discovered vulnerabilities, including a critical issue that could allow unauthorized access to the platform.

News

WordPress Vulnerability & Patch Roundup October 2024
Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-9528 Number of Installations: 500,000+ Affected Software: Contact Form Plugin by Fluent Forms <= 5.1.19 Patched Versions: Contact Form Plugin by Fluent Forms 5.1.20 Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-8499 Number of Installations: 400,000+ Affected Software: Checkout Field Editor for WooCommerce <= 2.0.3 Patched Versions: Checkout Field Editor for WooCommerce 2.0.4
WordPress Vulnerability &amp; Patch Roundup October 2024
Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-9528 Number of Installations: 500,000+ Affected Software: Contact Form Plugin by Fluent Forms <= 5.1.19 Patched Versions: Contact Form Plugin by Fluent Forms 5.1.20 Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-8499 Number of Installations: 400,000+ Affected Software: Checkout Field Editor for WooCommerce <= 2.0.3 Patched Versions: Checkout Field Editor for WooCommerce 2.0.4
WordPress Vulnerability &amp; Patch Roundup October 2024
Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-9528 Number of Installations: 500,000+ Affected Software: Contact Form Plugin by Fluent Forms <= 5.1.19 Patched Versions: Contact Form Plugin by Fluent Forms 5.1.20 Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-8499 Number of Installations: 400,000+ Affected Software: Checkout Field Editor for WooCommerce <= 2.0.3 Patched Versions: Checkout Field Editor for WooCommerce 2.0.4
Web Application Detections Published in October 2024
In October, Qualys released QIDs targeting vulnerabilities in several widely used software products, including WordPress, Zohocorp ManageEngine Endpoint, Lobe Chat, Ivanti Virtual Traffic Manager (vTM), Traefik, Nginx Proxy Manager, Harbor, Haproxy, SolarWinds Access Rights Manager (ARM), Cacti, Ivanti Endpoint Manager Mobile (EPMM), JetBrains TeamCity, Palo Alto Networks Expedition, Progress Telerik Report Server, Zimbra, Oracle WebLogic Server, Apache Solr, FlatPress CMS, pgAdmin, Grafana, pfSense, SolarWinds Web Help Desk, Ivanti Avalanche, ReCrystallize Server, Joomla!, and PHP. The QIDs released to detect the vulnerabilities in the frameworks above are listed below. Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. QID Title 152202 Zohocorp ManageEngine Endpoint Central Incorrect Authorization Vulnerability (CVE-2024-38868) 152206 WordPress Delicious Recipe Plugin: Arbitrary File Movement and Reading Vulnerability (CVE-2024-7626) 152207 WordPress Simple Spoiler Plugin: Arbitrary Shortcode Execution Vulnerability (CVE-2024-8479) 152209 WordPress PropertyHive Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8490) 152210 WordPress Share This Image Plugin: Open Redirect Vulnerability (CVE-2024-8761) 152215 WordPress infolinks Ad Wrap Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8044) 152216 WordPress Bit File Manager Plugin:
Update Sun Oct 27 14:34:00 UTC 2024
Update Sun Oct 27 14:34:00 UTC 2024
See 18 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI