CVE-2024-49229 - Vulnerability Details

Vendors	Products
Arifnezami	Better Author Bio

Link	Providers
https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve

Type	Values Removed	Values Added
First Time appeared		Arifnezami Arifnezami better Author Bio
CPEs		cpe:2.3:a:arifnezami:better_author_bio::::::wordpress::*
Vendors & Products		Arifnezami Arifnezami better Author Bio

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11.
Title		WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-352
References		https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-49229", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-10-14T10:39:06.929Z", "datePublished": "2024-10-17T17:51:01.756Z", "dateUpdated": "2024-10-17T18:02:57.641Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "better-author-bio", "product": "Better Author Bio", "vendor": "Arif Nezami", "versions": [{"lessThanOrEqual": "2.7.10.11", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "SOPROBRO (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).<p>This issue affects Better Author Bio: from n/a through 2.7.10.11.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-10-17T17:51:01.756Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-17T18:02:06.709734Z", "id": "CVE-2024-49229", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T18:02:57.641Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-49229 (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

state : PUBLISHED (string)

assignerShortName : Patchstack (string)

dateReserved : 2024-10-14T10:39:06.929Z (string)

datePublished : 2024-10-17T17:51:01.756Z (string)

dateUpdated : 2024-10-17T18:02:57.641Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

packageName : better-author-bio (string)

product : Better Author Bio (string)

vendor : Arif Nezami (string)

versions : [ »

0 : { »

lessThanOrEqual : 2.7.10.11 (string)

status : affected (string)

version : n/a (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : SOPROBRO (Patchstack Alliance) (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).<p>This issue affects Better Author Bio: from n/a through 2.7.10.11.</p> (string)

}

]

value : Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-63 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-63 Cross-Site Scripting (XSS) (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-352 (string)

description : CWE-352 Cross-Site Request Forgery (CSRF) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2024-10-17T17:51:01.756Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vdb-entry (string)

]

url : https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-17T18:02:06.709734Z (string)

id : CVE-2024-49229 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-17T18:02:57.641Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-49229", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-17T18:02:06.709734Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T18:02:46.769Z"}}], "cna": {"title": "WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "SOPROBRO (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arif Nezami", "product": "Better Author Bio", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "2.7.10.11"}], "packageName": "better-author-bio", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "references": [{"url": "https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).<p>This issue affects Better Author Bio: from n/a through 2.7.10.11.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-10-17T17:51:01.756Z"}}}, "cveMetadata": {"cveId": "CVE-2024-49229", "state": "PUBLISHED", "dateUpdated": "2024-10-17T18:02:57.641Z", "dateReserved": "2024-10-14T10:39:06.929Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-10-17T17:51:01.756Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-49229 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-17T18:02:06.709734Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-17T18:02:46.769Z (string)

}

]

cna : { »

title : WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability (string)

source : { »

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : SOPROBRO (Patchstack Alliance) (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-63 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-63 Cross-Site Scripting (XSS) (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : CHANGED (string)

version : 3.1 (string)

baseScore : 7.1 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Arif Nezami (string)

product : Better Author Bio (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

versionType : custom (string)

lessThanOrEqual : 2.7.10.11 (string)

}

]

packageName : better-author-bio (string)

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve (string)

tags : [ »

0 : vdb-entry (string)

]

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).<p>This issue affects Better Author Bio: from n/a through 2.7.10.11.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-352 (string)

description : CWE-352 Cross-Site Request Forgery (CSRF) (string)

}

]

}

]

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2024-10-17T17:51:01.756Z (string)

}

cveMetadata : { »

cveId : CVE-2024-49229 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-17T18:02:57.641Z (string)

dateReserved : 2024-10-14T10:39:06.929Z (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

datePublished : 2024-10-17T17:51:01.756Z (string)

assignerShortName : Patchstack (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arifnezami:better_author_bio:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "4689238E-3953-4D12-9B29-A93129F2C3B5", "versionEndIncluding": "2.7.10.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11."}, {"lang": "es", "value": "La vulnerabilidad de Cross-Site Request Forgery (CSRF) en Arif Nezami Better Author Bio permite Cross-Site Scripting (XSS). Este problema afecta a Better Author Bio: desde n/a hasta 2.7.10.11."}], "id": "CVE-2024-49229", "lastModified": "2024-11-06T20:40:30.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2024-10-17T18:15:09.893", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:arifnezami:better_author_bio:*:*:*:*:*:wordpress:*:* (string)

matchCriteriaId : 4689238E-3953-4D12-9B29-A93129F2C3B5 (string)

versionEndIncluding : 2.7.10.11 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11. (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad de Cross-Site Request Forgery (CSRF) en Arif Nezami Better Author Bio permite Cross-Site Scripting (XSS). Este problema afecta a Better Author Bio: desde n/a hasta 2.7.10.11. (string)

}

]

id : CVE-2024-49229 (string)

lastModified : 2024-11-06T20:40:30.740 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.7 (number)

source : audit@patchstack.com (string)

type : Secondary (string)

}

]

}

published : 2024-10-17T18:15:09.893 (string)

references : [ »

0 : { »

source : audit@patchstack.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://patchstack.com/database/vulnerability/better-author-bio/wordpress-better-author-bio-plugin-2-7-10-11-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve (string)

}

]

sourceIdentifier : audit@patchstack.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : audit@patchstack.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object