Multiple WordPress Plugins Vulnerabilities
January 30, 2025Multiple WordPress Plugins Vulnerabilities
January 30, 2025Severity
Medium
Analysis Summary
CVE-2024-20441 CVSS:5.7
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to download config only or full backup files and learn sensitive.
CVE-2024-20438 CVSS:5.7
A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions such as reading device configuration information.
CVE-2024-20385 CVSS:5.9
A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitive information from an affected device. This vulnerability exists because the Cisco NDO Validate Peer Certificate site management feature validates the certificates for Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud Network Controller (CNC), and Cisco Nexus Dashboard only when a new site is added or an exist.
CVE-2024-20365 CVSS:6.5
A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by sending crafted commands through the Redfish API on an affected device.
CVE-2024-20521 CVSS:6.5
Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of user-supplied input in the web-based management interface. By sending specially crafted HTTP requests, an attacker could exploit this vulnerability to execute arbitrary code on the underlying operating system as the root user.
CVE-2024-20513 CVSS:5.8
Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN is vulnerable to a denial of service, caused by improper entropy for handlers that are used during SSL VPN session establishment. By sending a specially crafted HTTPS request using the brute-forced or predicted session handler, a remote attacker could exploit this vulnerability to terminate targeted SSL VPN sessions.
CVE-2024-20502 CVSS:5.8
Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN is vulnerable to a denial of service, caused by improper resource management while establishing SSL VPN sessions. By sending specially crafted HTTPS requests, a remote attacker could exploit this vulnerability to cause AnyConnect VPN server to stop accepting new connections.
CVE-2024-20500 CVSS:5.8
Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN is vulnerable to a denial of service, caused by improper resource management while establishing SSL VPN sessions. By sending specially crafted HTTPS requests, a remote attacker could exploit this vulnerability to cause AnyConnect VPN server to stop accepting new connections.
Impact
- Code Execution
- Denial of Service
- Gain Access
Indicators of Compromise
CVE
CVE-2024-20441
CVE-2024-20438
CVE-2024-20385
CVE-2024-20365
CVE-2024-20521
CVE-2024-20513
CVE-2024-20502
CVE-2024-20500
Affected Vendors
- Cisco
Affected Products
- Cisco RV042 Dual WAN VPN Routers
- Cisco RV042G Dual Gigabit WAN VPN Routers
- Cisco RV320 Dual Gigabit WAN VPN Routers
- Cisco RV325 Dual Gigabit WAN VPN Routers
- Cisco Meraki MX64W
- Cisco Meraki MX65W
- Cisco Meraki MX68
- Cisco Data Center Network Manager - 12.1(1) - 12.0.1a - 12.0.2d - 12.0.2f - 12.1.1 - 12.1.1e
- Cisco Nexus Dashboard Orchestrator - 3.7(1d) - 3.7(1g) - 3.7(1h) - 3.7(1j) - 3.7(1i) - 3.7(1k)
- Cisco Unified Computing System (Managed) - 4.1(2a) - 4.1(2b) - 4.1(3a) - 4.1(3b) - 4.1(2c) - 4.1(4a)
- Cisco Meraki MX64W
Remediation
Refer to Cisco Security Advisory for patch, upgrade, or suggested workaround information.