CVE-2024-43274 (GCVE-0-2024-43274)

Vulnerability from cvelistv5 – Published: 2024-11-01 14:17 – Updated: 2024-11-05 21:37
VLAI?
Title
WordPress JS Help Desk – The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.
Severity ?
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
JS Help Desk JS Help Desk – Best Help Desk & Support Plugin Affected: n/a , ≤ 2.8.6 (custom)
Create a notification for this product.
Credits
Fariq Fadillah Gusti Insani (Patchstack Alliance)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:jshelpdesk:jshelpdesk:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jshelpdesk",
            "vendor": "jshelpdesk",
            "versions": [
              {
                "lessThanOrEqual": "2.8.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43274",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-01T19:05:54.575584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T21:37:16.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "js-support-ticket",
          "product": "JS Help Desk \u2013 Best Help Desk \u0026 Support Plugin",
          "vendor": "JS Help Desk",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.8.7",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.8.6",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Fariq Fadillah Gusti Insani (Patchstack Alliance)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in JS Help Desk JS Help Desk \u2013 Best Help Desk \u0026amp; Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects JS Help Desk \u2013 Best Help Desk \u0026amp; Support Plugin: from n/a through 2.8.6.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in JS Help Desk JS Help Desk \u2013 Best Help Desk \u0026 Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk \u2013 Best Help Desk \u0026 Support Plugin: from n/a through 2.8.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-01T14:17:32.655Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to 2.8.7 or a higher version."
            }
          ],
          "value": "Update to 2.8.7 or a higher version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress JS Help Desk \u2013 The Ultimate Help Desk plugin \u003c= 2.8.6 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2024-43274",
    "datePublished": "2024-11-01T14:17:32.655Z",
    "dateReserved": "2024-08-09T09:20:56.506Z",
    "dateUpdated": "2024-11-05T21:37:16.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Missing Authorization vulnerability in JS Help Desk JS Help Desk \\u2013 Best Help Desk \u0026 Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk \\u2013 Best Help Desk \u0026 Support Plugin: from n/a through 2.8.6.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de autorizaci\\u00f3n faltante en JS Help Desk JS Help Desk \\u2013 Best Help Desk \u0026amp; Support Plugin permite acceder a funcionalidades que no est\\u00e1n correctamente restringidas por las ACL. Este problema afecta a JS Help Desk \\u2013 Best Help Desk \u0026amp; Support Plugin: desde n/a hasta 2.8.6.\"}]",
      "id": "CVE-2024-43274",
      "lastModified": "2024-11-01T20:24:53.730",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"audit@patchstack.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\", \"baseScore\": 5.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-11-01T15:15:44.710",
      "references": "[{\"url\": \"https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve\", \"source\": \"audit@patchstack.com\"}]",
      "sourceIdentifier": "audit@patchstack.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"audit@patchstack.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-862\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43274\",\"sourceIdentifier\":\"audit@patchstack.com\",\"published\":\"2024-11-01T15:15:44.710\",\"lastModified\":\"2024-11-01T20:24:53.730\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing Authorization vulnerability in JS Help Desk JS Help Desk \u2013 Best Help Desk \u0026 Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk \u2013 Best Help Desk \u0026 Support Plugin: from n/a through 2.8.6.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de autorizaci\u00f3n faltante en JS Help Desk JS Help Desk \u2013 Best Help Desk \u0026amp; Support Plugin permite acceder a funcionalidades que no est\u00e1n correctamente restringidas por las ACL. Este problema afecta a JS Help Desk \u2013 Best Help Desk \u0026amp; Support Plugin: desde n/a hasta 2.8.6.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"audit@patchstack.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"audit@patchstack.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve\",\"source\":\"audit@patchstack.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43274\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-01T19:05:54.575584Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:jshelpdesk:jshelpdesk:*:*:*:*:*:wordpress:*:*\"], \"vendor\": \"jshelpdesk\", \"product\": \"jshelpdesk\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.8.6\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-05T21:37:08.321Z\"}}], \"cna\": {\"title\": \"WordPress JS Help Desk \\u2013 The Ultimate Help Desk plugin \u003c= 2.8.6 - Broken Access Control vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Fariq Fadillah Gusti Insani (Patchstack Alliance)\"}], \"impacts\": [{\"capecId\": \"CAPEC-1\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"JS Help Desk\", \"product\": \"JS Help Desk \\u2013 Best Help Desk \u0026 Support Plugin\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"2.8.7\", \"status\": \"unaffected\"}], \"version\": \"n/a\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.8.6\"}], \"packageName\": \"js-support-ticket\", \"collectionURL\": \"https://wordpress.org/plugins\", \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update to 2.8.7 or a higher version.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Update to 2.8.7 or a higher version.\", \"base64\": false}]}], \"references\": [{\"url\": \"https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-the-ultimate-help-desk-support-plugin-plugin-2-8-6-broken-access-control-vulnerability?_s_id=cve\", \"tags\": [\"vdb-entry\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing Authorization vulnerability in JS Help Desk JS Help Desk \\u2013 Best Help Desk \u0026 Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk \\u2013 Best Help Desk \u0026 Support Plugin: from n/a through 2.8.6.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Missing Authorization vulnerability in JS Help Desk JS Help Desk \\u2013 Best Help Desk \u0026amp; Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects JS Help Desk \\u2013 Best Help Desk \u0026amp; Support Plugin: from n/a through 2.8.6.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"shortName\": \"Patchstack\", \"dateUpdated\": \"2024-11-01T14:17:32.655Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43274\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T21:37:16.148Z\", \"dateReserved\": \"2024-08-09T09:20:56.506Z\", \"assignerOrgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"datePublished\": \"2024-11-01T14:17:32.655Z\", \"assignerShortName\": \"Patchstack\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.