CVE-2024-7870

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-7870
The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd7a515-6389-4152-8dac-d5497dd94f6d?source=cve Third Party Advisory
https://github.com/WordpressPluginDirectory/pixelyoursite/blob/main/pixelyoursite/includes/logger/class-pys-logger.php#L126 Product
https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/includes/class-pys.php#L114 Product
https://plugins.trac.wordpress.org/changeset/3143047/ Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pixelyoursite:pixelyoursite:*:*:*:*:-:wordpress:*:*
cpe:2.3:a:pixelyoursite:pixelyoursite:*:*:*:*:pro:wordpress:*:*
History

07 Oct 2024, 12:29

Type Values Removed Values Added
First Time Pixelyoursite
Pixelyoursite pixelyoursite
CPE cpe:2.3:a:pixelyoursite:pixelyoursite:*:*:*:*:-:wordpress:*:*
cpe:2.3:a:pixelyoursite:pixelyoursite:*:*:*:*:pro:wordpress:*:*
References () https://plugins.trac.wordpress.org/changeset/3143047/ - () https://plugins.trac.wordpress.org/changeset/3143047/ - Patch
References () https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/includes/class-pys.php#L114 - () https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/includes/class-pys.php#L114 - Product
References () https://github.com/WordpressPluginDirectory/pixelyoursite/blob/main/pixelyoursite/includes/logger/class-pys-logger.php#L126 - () https://github.com/WordpressPluginDirectory/pixelyoursite/blob/main/pixelyoursite/includes/logger/class-pys-logger.php#L126 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd7a515-6389-4152-8dac-d5497dd94f6d?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd7a515-6389-4152-8dac-d5497dd94f6d?source=cve - Third Party Advisory
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 7.5

04 Sep 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-04 09:15

Updated : 2024-10-07 12:29

NVD link : CVE-2024-7870

Mitre link : CVE-2024-7870

JSON object : View

Products Affected

pixelyoursite

  • pixelyoursite
CWE
CWE-287

Improper Authentication