jvndb - jvndb-2024-000001

jvndb-2024-000001

Vulnerability from jvndb

Published

2024-01-12 13:51

Modified

2024-03-14 12:28

Severity ?

5.0 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Summary

Improper input validation vulnerability in WordPress Plugin "WordPress Quiz Maker Plugin"

Details

WordPress Plugin "WordPress Quiz Maker Plugin" provided by AYS Pro Plugins contains an improper input validation vulnerability (CWE-20). Shogo Kumamaru of LAC CyberLink Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN37326856/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-22027
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2024-22027
	Improper Input Validation(CWE-20)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	AYS Pro Plugins	WordPress Quiz Maker

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000001.html",
  "dc:date": "2024-03-14T12:28+09:00",
  "dcterms:issued": "2024-01-12T13:51+09:00",
  "dcterms:modified": "2024-03-14T12:28+09:00",
  "description": "WordPress Plugin \"WordPress Quiz Maker Plugin\" provided by AYS Pro Plugins contains an improper input validation vulnerability (CWE-20).\r\n\r\nShogo Kumamaru of LAC CyberLink Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000001.html",
  "sec:cpe": {
    "#text": "cpe:/a:ays-pro:quiz_maker",
    "@product": "WordPress Quiz Maker",
    "@vendor": "AYS Pro Plugins",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2024-000001",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN37326856/index.html",
      "@id": "JVN#37326856",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-22027",
      "@id": "CVE-2024-22027",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2024-22027",
      "@id": "CVE-2024-22027",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "Improper input validation vulnerability in WordPress Plugin \"WordPress Quiz Maker Plugin\""
}

cve-2024-22027

Vulnerability from cvelistv5

Published

2024-01-12 06:41

Modified

2024-09-25 20:28

Severity ?

Summary

Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.

References

▼	URL	Tags
	https://wordpress.org/plugins/quiz-maker/
	https://jvn.jp/en/jp/JVN37326856/

Impacted products

▼	Vendor	Product
	AYS Pro Plugins	WordPress Quiz Maker Plugin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:35:34.452Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/quiz-maker/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN37326856/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22027",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T20:27:57.229321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T20:28:14.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WordPress Quiz Maker Plugin",
          "vendor": "AYS Pro Plugins",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 6.5.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper input validation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T06:41:29.452Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://wordpress.org/plugins/quiz-maker/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN37326856/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-22027",
    "datePublished": "2024-01-12T06:41:29.452Z",
    "dateReserved": "2024-01-04T01:13:22.923Z",
    "dateUpdated": "2024-09-25T20:28:14.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted