CVE-2024-37091

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixThemes Masterstudy Elementor Widgets allows OS Command Injection.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0; Masterstudy Elementor Widgets: from n/a through 1.2.2.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-remote-code-execution-rce-vulnerability?_s_id=cve	Third Party Advisory
https://patchstack.com/database/vulnerability/masterstudy-elementor-widgets/wordpress-masterstudy-elementor-widgets-plugin-1-2-2-remote-code-execution-rce-vulnerability?_s_id=cve

Configurations

Configuration 1 (hide)

cpe:2.3:a:stylemixthemes:consulting_elementor_widgets:*:*:*:*:*:wordpress:*:*

History

20 Oct 2024, 12:15

Type	Values Removed	Values Added
References		() https://patchstack.com/database/vulnerability/masterstudy-elementor-widgets/wordpress-masterstudy-elementor-widgets-plugin-1-2-2-remote-code-execution-rce-vulnerability?_s_id=cve -
Summary	(en) Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets allows OS Command Injection.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0.	(en) Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixThemes Masterstudy Elementor Widgets allows OS Command Injection.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0; Masterstudy Elementor Widgets: from n/a through 1.2.2.

16 Aug 2024, 14:08

Type	Values Removed	Values Added
CPE		cpe:2.3:a:stylemixthemes:consulting_elementor_widgets::::::wordpress::*
Summary		(es) La neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando ("Inyección de comando") en StylemixThemes Consulting Elementor Widgets permite la inyección de comandos del sistema operativo. Este problema afecta a Consulting Elementor Widgets: desde n/a hasta 1.3.0.
First Time		Stylemixthemes Stylemixthemes consulting Elementor Widgets
CWE		CWE-78
References	~~() https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-remote-code-execution-rce-vulnerability?_s_id=cve -~~	() https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-remote-code-execution-rce-vulnerability?_s_id=cve - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~9.9~~	v2 : unknown v3 : 8.8

24 Jun 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-24 12:15

Updated : 2024-10-20 12:15

NVD link : CVE-2024-37091

Mitre link : CVE-2024-37091

CVE.ORG link : CVE-2024-37091

JSON object : View

Products Affected

stylemixthemes

consulting_elementor_widgets

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

8.8 /10