CVE-2024-6499

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Configurations

Configuration 1 (hide)

cpe:2.3:a:maxfoundry:maxbuttons:*:*:*:*:*:wordpress:*:*

History

26 Sep 2024, 22:07

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/maxbuttons/trunk/assets/libraries/font-awesome-5/convert.php - () https://plugins.trac.wordpress.org/browser/maxbuttons/trunk/assets/libraries/font-awesome-5/convert.php - Product
References () https://plugins.trac.wordpress.org/changeset/3140369/maxbuttons/tags/9.8.0/assets/libraries/font-awesome-5/convert.php - () https://plugins.trac.wordpress.org/changeset/3140369/maxbuttons/tags/9.8.0/assets/libraries/font-awesome-5/convert.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd0694c-ea7e-4cf8-a8d8-82a2b02fecdf?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd0694c-ea7e-4cf8-a8d8-82a2b02fecdf?source=cve - Third Party Advisory
CPE cpe:2.3:a:maxfoundry:maxbuttons:*:*:*:*:*:wordpress:*:*
CWE NVD-CWE-noinfo
First Time Maxfoundry
Maxfoundry maxbuttons

26 Aug 2024, 12:47

Type Values Removed Values Added
Summary
  • (es) El complemento WordPress Button Plugin MaxButtons para WordPress es vulnerable a la exposición de información en todas las versiones hasta la 9.7.8 incluida. Esto hace posible que los atacantes no autenticados obtengan la ruta completa a las instancias, que pueden utilizar en combinación con otras vulnerabilidades o para simplificar el trabajo de reconocimiento. Por sí sola, esta información tiene una utilidad muy limitada.

24 Aug 2024, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-24 04:15

Updated : 2024-09-26 22:07


NVD link : CVE-2024-6499

Mitre link : CVE-2024-6499

CVE.ORG link : CVE-2024-6499


JSON object : View

Products Affected

maxfoundry

  • maxbuttons
CWE
NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor