CVE-2024-6522

NVD Published Date: August 07, 2024 at 11:15 AM
NVD Last Modified: August 07, 2024 at 03:17 PM
Download Patch
Vulnerability ID
CVE-2024-6522
Severity
HIGH
Severity Score
8.5
Summary
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
References
Mitigation and Patches
-
Exploits
-
Metasploit Payload
-
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CWE ID
None

Recent Publish

CVE-2024-7266

CVE-2024-7267

CVE-2024-7353

CVE-2024-7355

CVE-2024-7578

2024-07 Dynamic Cumulative Update for Windows 11 for x64-based Systems (KB5040431)

See SecOps Solution
in action

Schedule Demo
Agentless security for your infrastructure and applications - to build faster, more securely and in a fraction of the operational cost of other solutions
hello@secopsolution.com
+569-231-213
Compare
Qualys Cloud Agent Tenable Nessus Rapid7 InsightVM
Company
About Us Contact Career
Resources
CVE Windows KB Case Studies eBooks Policy Templates Blog Webinar
Try It
Patch Astra EPSS Calculator Contact Free Scan Schedule Demo Log In
© 2024  SecOps Solution, Inc.| Privacy Policy | Terms and Conditions .
Social Media :