CVE-2024-2543 - Vulnerability Details - OpenCVE

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Permalink Manager Lite Project	Permalink Manager Lite

Configuration 1 [-]

cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894
https://plugins.trac.wordpress.org/changeset/3053899/
https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve

History

Wed, 05 Feb 2025 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Permalink Manager Lite Project Permalink Manager Lite Project permalink Manager Lite
Weaknesses		CWE-862
CPEs		cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite::::::wordpress::*
Vendors & Products		Permalink Manager Lite Project Permalink Manager Lite Project permalink Manager Lite

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-04-09T18:58:58.216Z

Updated: 2024-08-01T19:18:46.970Z

Reserved: 2024-03-15T18:47:44.224Z

Link: CVE-2024-2543

Vulnrichment

Updated: 2024-08-01T19:18:46.970Z

NVD

Status : Analyzed

Published: 2024-04-09T19:15:35.433

Modified: 2025-02-05T17:11:54.403

Link: CVE-2024-2543

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2543", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-03-15T18:47:44.224Z", "datePublished": "2024-04-09T18:58:58.216Z", "dateUpdated": "2024-08-01T19:18:46.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-04-09T18:58:58.216Z"}, "affected": [{"vendor": "mbis", "product": "Permalink Manager Lite", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "2.4.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts."}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve"}, {"url": "https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894"}, {"url": "https://plugins.trac.wordpress.org/changeset/3053899/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "timeline": [{"time": "2024-03-20T00:00:00.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2543", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T18:48:35.733380Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:29:41.503Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:46.970Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/changeset/3053899/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/changeset/3053899/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:46.970Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2543", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T18:48:35.733380Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-20T18:48:40.351Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "mbis", "product": "Permalink Manager Lite", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.4.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-03-20T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve"}, {"url": "https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894"}, {"url": "https://plugins.trac.wordpress.org/changeset/3053899/"}], "descriptions": [{"lang": "en", "value": "The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-04-09T18:58:58.216Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2543", "state": "PUBLISHED", "dateUpdated": "2024-08-01T19:18:46.970Z", "dateReserved": "2024-03-15T18:47:44.224Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-04-09T18:58:58.216Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:permalink_manager_lite_project:permalink_manager_lite:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "CB4E94F1-7845-4825-BE95-03FF85EFD4BC", "versionEndExcluding": "2.4.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts."}, {"lang": "es", "value": "El complemento Permalink Manager Lite para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n 'get_uri_editor' en todas las versiones hasta la 2.4.3.1 incluida. Esto hace posible que atacantes no autenticados vean los enlaces permanentes de todas las publicaciones."}], "id": "CVE-2024-2543", "lastModified": "2025-02-05T17:11:54.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2024-04-09T19:15:35.433", "references": [{"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3053899/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3053899/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}