CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-6569

Medium Severity
SVRS
30/100
CVSSv3
NA/10
EPSS
0.00212/1

CVE-2024-6569 affects the Campaign Monitor for WordPress plugin, exposing the full path of the web application. This vulnerability, present in versions up to 2.8.15, stems from unrestricted access to 'create.php' and 'display_errors' being enabled. Unauthenticated attackers can exploit this to retrieve the server path, useful for planning further attacks. While the path disclosure itself doesn't directly cause damage, it aids in exploiting other vulnerabilities. With an SVRS of 30, the threat is considered low, but the potential for chained attacks makes vigilance important. Mitigation involves restricting access and disabling 'display_errors'. Despite the low SVRS, organizations should address this to minimize their overall attack surface.

TAGS
In The Wild
VECTOR STRING
PUBLICATION DATE2024-07-27
LAST MODIFIED2024-07-29
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-6569 is a Full Path Disclosure vulnerability in the Campaign Monitor for WordPress plugin for WordPress, affecting versions up to 2.8.15. It allows unauthenticated attackers to retrieve the full path of the web application, which can aid other attacks. The SVRS of 46 indicates a moderate risk, requiring attention but not immediate action.

Key Insights

  • Unauthenticated Access: Attackers can exploit this vulnerability without requiring any authentication, making it easier for them to target websites.
  • Limited Impact: The vulnerability itself does not cause direct damage to the website. However, it can be used in conjunction with other vulnerabilities to compromise the system.
  • Exploit Availability: Active exploits have been published, increasing the risk of exploitation.
  • CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.

Mitigation Strategies

  • Update the Plugin: Install the latest version of the Campaign Monitor for WordPress plugin (2.8.16 or later) to patch the vulnerability.
  • Disable Display Errors: Disable the display_errors PHP setting to prevent the full path from being displayed in error messages.
  • Restrict Access: Implement access controls to limit who can access the /forms/views/admin/create.php file.
  • Monitor for Suspicious Activity: Regularly monitor website logs for any suspicious activity that may indicate exploitation attempts.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-6569 | Campaign Monitor Plugin up to 2.8.15 on WordPress information disclosure
vuldb.com2024-07-27
CVE-2024-6569 | Campaign Monitor Plugin up to 2.8.15 on WordPress information disclosure | A vulnerability classified as problematic has been found in Campaign Monitor Plugin up to 2.8.15 on WordPress. This affects an unknown part. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2024-6569. It is possible to initiate the attack remotely. There is no exploit available.
cve-2024-6569
domains
urls
cves

Social Media

CVE-2024-6569 Full Path Disclosure in Campaign Monitor for WordPress Plugin The Campaign Monitor for WordPress plugin has a Full Path Disclosure issue in all versions up to 2.8.15. This happens because the plugin... https://t.co/txMkrD0QzE
0
0
0
CVE-2024-6569 The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not p… https://t.co/zdXGUj9zFE
0
0
0

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://plugins.trac.wordpress.org/browser/forms-for-campaign-monitor/trunk/forms/views/admin/create.php
[email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3125580%40forms-for-campaign-monitor&new=3125580%40forms-for-campaign-monitor&sfp_email=&sfph_mail=
[email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/babf88c4-6328-4ba2-97e4-e1eaaa549dbb?source=cve

CWE Details

CWE IDCWE NameDescription
CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence