« Volver al listado

CVE-2024-38345

Estado: AplazadaAlta (8.1)—

A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sola Testimonials — Sola TestimonialsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38345",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38345",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-08T18:19:11.960597Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Sola Plugins",
          "product": "Sola Testimonials",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to 3.0.0"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:solaplugins:sola_testimonials:*:*:*:*:*:*:*:*"
          ],
          "vendor": "solaplugins",
          "product": "sola_testimonials",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.0.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-04T01:15:02.340",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN34977158/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://wordpress.org/plugins/sola-testimonials/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN34977158/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/sola-testimonials/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de Cross-Site Request Forgery en las versiones de Sola Testimonials anteriores a la 3.0.0. Si se explota esta vulnerabilidad, un atacante permite que un usuario que inicia sesión en el sitio de WordPress donde está habilitado el complemento afectado acceda a una página maliciosa. Como resultado, el usuario puede realizar operaciones no deseadas en el sitio de WordPress."
    }
  ],
  "lastModified": "2026-06-17T07:39:57.987",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}