CVE-2024-6590

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6590
The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 3.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit post status, edit Google sheet integrations, and create Google sheet integrations.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L1168 Product
https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L812 Product
https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L863 Product
https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L935 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ff2cc-9af2-4b72-bc49-e205275daa4d?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:javmah:spreadsheet_integration:*:*:*:*:*:wordpress:*:*
History

30 Sep 2024, 14:31

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L1168 - () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L1168 - Product
References () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L812 - () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L812 - Product
References () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L863 - () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L863 - Product
References () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L935 - () https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L935 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ff2cc-9af2-4b72-bc49-e205275daa4d?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ff2cc-9af2-4b72-bc49-e205275daa4d?source=cve - Third Party Advisory
CVSS v2 : unknown
v3 : 6.3 		v2 : unknown
v3 : 4.3
CPE cpe:2.3:a:javmah:spreadsheet_integration:*:*:*:*:*:wordpress:*:*
First Time Javmah spreadsheet Integration
Javmah

26 Sep 2024, 13:32

Type Values Removed Values Added
Summary
  • (es) El complemento Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table para WordPress es vulnerable a la modificación no autorizada de datos debido a una verificación de capacidad faltante en varias funciones en todas las versiones hasta la 3.7.9 incluida. Esto permite que los atacantes autenticados, con acceso de nivel de suscriptor y superior, editen el estado de las publicaciones, editen integraciones de hojas de cálculo de Google y creen integraciones de hojas de cálculo de Google.

25 Sep 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-25 03:15

Updated : 2024-09-30 14:31

NVD link : CVE-2024-6590

Mitre link : CVE-2024-6590

CVE.ORG link : CVE-2024-6590

JSON object : View

Products Affected

javmah

  • spreadsheet_integration
CWE
CWE-862

Missing Authorization