CVE-2024-9822

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

Published: Oct 11, 2024 / Updated: 40d ago

010
CVSS 9.8EPSS 0.09%Critical
CVE info copied to clipboard

Summary

The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator.

Impact

This vulnerability allows unauthenticated attackers to gain administrative access to WordPress sites using the Pedalo Connector plugin. Once an attacker gains administrative access, they can potentially take full control of the website, including modifying content, installing malicious plugins, accessing sensitive user data, or using the compromised site for further attacks. The CVSS base score of 9.8 (Critical) indicates that this vulnerability has a severe impact on the confidentiality, integrity, and availability of the affected systems.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects versions up to and including 2.0.5 of the Pedalo Connector plugin, it is likely that an updated version addressing this issue may be available or forthcoming.

Mitigation

1. Immediately update the Pedalo Connector plugin to a version newer than 2.0.5 if available. 2. If an update is not available, consider temporarily disabling the Pedalo Connector plugin until a patch is released. 3. Implement strong access controls and monitor for any unauthorized access attempts. 4. Regularly audit user accounts, especially those with administrative privileges, to detect any suspicious activities. 5. Consider implementing additional security measures such as two-factor authentication for administrative accounts. 6. Keep WordPress core, themes, and all plugins up to date to minimize overall security risks.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9822. See article

Oct 10, 2024 at 8:06 PM / #WordPress
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 10, 2024 at 8:48 PM
CVE Assignment

NVD published the first details for CVE-2024-9822

Oct 11, 2024 at 3:15 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 11, 2024 at 3:20 AM / nvd
EPSS

EPSS Score was set to: 0.09% (Percentile: 39.8%)

Oct 11, 2024 at 10:19 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (152298)

Oct 14, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Pedalo/pedalo_connector
+null more

Links to Mitre Att&cks

T1083: File and Directory Discovery
+null more

Attack Patterns

CAPEC-127: Directory Indexing
+null more

News

Web Application Detections Published in October 2024
In October, Qualys released QIDs targeting vulnerabilities in several widely used software products, including WordPress, Zohocorp ManageEngine Endpoint, Lobe Chat, Ivanti Virtual Traffic Manager (vTM), Traefik, Nginx Proxy Manager, Harbor, Haproxy, SolarWinds Access Rights Manager (ARM), Cacti, Ivanti Endpoint Manager Mobile (EPMM), JetBrains TeamCity, Palo Alto Networks Expedition, Progress Telerik Report Server, Zimbra, Oracle WebLogic Server, Apache Solr, FlatPress CMS, pgAdmin, Grafana, pfSense, SolarWinds Web Help Desk, Ivanti Avalanche, ReCrystallize Server, Joomla!, and PHP. The QIDs released to detect the vulnerabilities in the frameworks above are listed below. Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. QID Title 152202 Zohocorp ManageEngine Endpoint Central Incorrect Authorization Vulnerability (CVE-2024-38868) 152206 WordPress Delicious Recipe Plugin: Arbitrary File Movement and Reading Vulnerability (CVE-2024-7626) 152207 WordPress Simple Spoiler Plugin: Arbitrary Shortcode Execution Vulnerability (CVE-2024-8479) 152209 WordPress PropertyHive Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8490) 152210 WordPress Share This Image Plugin: Open Redirect Vulnerability (CVE-2024-8761) 152215 WordPress infolinks Ad Wrap Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8044) 152216 WordPress Bit File Manager Plugin:
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 7, 2024 to October 13, 2024)
WordPress Plugins with Reported Vulnerabilities Last Week The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
Update Sun Oct 13 14:25:38 UTC 2024
Update Sun Oct 13 14:25:38 UTC 2024
Multiple Critical Vulnerabilities in WordPress (CVE-2024-9234, CVE-2024-9707, CVE-2024-9822)
WordPress is vulnerable to critical vulnerabilities . Exploitation of these vulnerabilities may allow an unauthenticated attacker to execute code ...
CVE-2024-9822
Critical Severity Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator. Read more at https://www.tenable.com/cve/CVE-2024-9822
See 10 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI