CVE-2024-6332: Amelia WordPress Plugin Missing Authorization Sensitive Info Exposure

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Booking for Appointments and Events Calendar - Amelia Premium <= 7.7 and Lite <= 1.2.3 - Missing Authorization to Sensitive Information Exposure 2. Rating: 6.5 (Medium) 3. CVE ID: CVE-2024-6332 4. CVSS Score: 6.5 5. Public Release Date: September 4, 2024 6. Update Date: September 5, 2024 7. Researcher: Nadim Zubidat 8. Affected Software Packages: - Booking for Appointments and Events Calendar - Amelia - Booking for Appointments and Events Calendar - Amelia Premium 9. Affected Versions: - Booking for Appointments and Events Calendar - Amelia <= 1.2.3 - Booking for Appointments and Events Calendar - Amelia Premium <= 7.7 10. Description: Due to missing authorization checks in the ameliabooking functionality across all versions of the Booking for Appointments and Events Calendar - Amelia Premium and Lite plugins, unauthorized attackers can access employee calendar details, including Google Calendar OAuth tokens in the Premium version. 11. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org 12. Remediation Advice: No known patch is available. It is recommended to review the vulnerability details based on your organization’s risk tolerance and take appropriate remediation actions. Uninstalling the affected software and finding an alternative is the best course of action. 13. Affected Software Type: Plugin 14. Affected Software Slug: - ameliabooking (view on wordpress.org) 15. Is Fixed?: No 16. Vulnerability Type: Missing Authorization 17. Disclosure Status: Public 18. Copyright Information: - Defiant Inc. (2012-2024) - MITRE Corporation (1999-2024) 19. License: - Defiant Inc. grants rights to copy, prepare derivative works, publicly display, publicly perform, distribute, and sublicense. - MITRE Corporation grants rights to copy, prepare derivative works, publicly display, publicly perform, distribute, and sublicense. 20. Contact: wfi-support@wordfence.com 21. Documentation: Wordfence Intelligence WordPress Vulnerability Database is completely free and accessible via API for querying.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-6332: Amelia WordPress Plugin Missing Authorization Sensitive Info Exposure

More from this source