CVE-2024-32112
Assigner: Patchstack
Published: 2024-04-11T12:01:39.193Z
State: PUBLISHED
affected: collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: leadinfo
product: Leadinfo
vendor: Leadinfo
versions: lessThanOrEqual: 1.0
status: affected
version: n/a
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Nguyen Xuan Chien (Patchstack Alliance)
descriptions: supportingMedia: base64: no
type: text/html
value: Cross-Site Request Forgery (CSRF) vulnerability in Leadinfo leadinfo. The patch was released under the same version which was reported as vulnerable. We consider the current version as vulnerable.<p>This issue affects Leadinfo: from n/a through 1.0.</p>
value: Cross-Site Request Forgery (CSRF) vulnerability in Leadinfo leadinfo. The patch was released under the same version which was reported as vulnerable. We consider the current version as vulnerable.This issue affects Leadinfo: from n/a through 1.0.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: EXTERNAL
timeline: time: 2023-11-27T11:48:00.000Z
value: Vendor notified about the vulnerability.
time: 2024-03-07T11:51:00.000Z
value: The patch was released under the same version that was reported as vulnerable.
time: 2024-03-20T12:59:00.000Z
value: Vendor notified about the issue with patch version number.
title: WordPress Leadinfo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
x_generator: engine: Vulnogram 0.1.0-dev