« Volver al listado

CVE-2024-9422

Estado: AnalizadaMedia (6.6)—

The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Geomywp — GEO MY WordpressGeomywp — GEO MY Wordpress Premium Settings

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-9422",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9422",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-22T17:46:13.344508Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.7
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "GEO my WP",
          "versions": [
            {
              "status": "affected",
              "version": "4.0",
              "lessThan": "4.5",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Unknown",
          "product": "gmw-premium-settings",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:geomywp:geo_my_wordpress:*:*:*:*:*:wordpress:*:*"
          ],
          "vendor": "geomywp",
          "product": "geo_my_wordpress",
          "versions": [
            {
              "status": "affected",
              "version": "4.0",
              "lessThan": "4.5",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-22T06:15:20.370",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/81320923-767c-43f0-a8eb-b398c306c16f/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server."
    },
    {
      "lang": "es",
      "value": "El complemento GEO my WP para WordPress anterior a la versión 4.5 y el complemento gmw-premium-settings para WordPress anterior a la versión 3.1 no validan suficientemente los archivos que se van a cargar, lo que podría permitir a los atacantes cargar archivos arbitrarios como PHP en el servidor."
    }
  ],
  "lastModified": "2026-06-17T08:24:32.633",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:geomywp:geo_my_wordpress:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97249232-7F87-42C9-8141-CA6A47E96B45",
              "versionEndExcluding": "4.5"
            },
            {
              "criteria": "cpe:2.3:a:geomywp:geo_my_wordpress_premium_settings:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4972FBDA-85B9-4444-AFF5-98F5CD643D7E",
              "versionEndExcluding": "3.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}