WordPress HTML5 Video Player Plugin Missing Authorization Vulnerability

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: HTML5 Video Player - mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler 2. Vulnerability Description: - Describes the nature of the vulnerability: Due to missing authorization checks for the AJAX action in multiple functions, unauthorized access to data is possible. - Scope of impact: This vulnerability exists in all versions up to and including 2.5.32. 3. Vulnerability Rating: - CVSS 3.1 Score: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1 Score: 5.3 (Medium) 4. Vulnerability Disclosure Date: September 10, 2024 5. Vulnerability Update Date: September 11, 2024 6. Vulnerability Researcher: Lucio Sá 7. Vulnerability Status: - Fixed: Yes - Fixed Version: 2.5.33 8. Affected Versions: <= 2.5.32 9. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 10. Exploitation: - No specific exploitation method is provided, but the possibility of unauthorized data access is described. 11. Copyright and Licensing Information: - Copyright: Defiant Inc. and MITRE Corporation - License: MITRE’s Common Vulnerabilities and Exposures (CVE) License 12. Impact: - Describes that the vulnerability may allow unauthorized access to data, but no specific attack vectors or exploitation methods are provided. This information helps in understanding the nature, scope, and remediation status of the vulnerability, as well as how to use it to protect one’s website.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress HTML5 Video Player Plugin Missing Authorization Vulnerability

More from this source