Create CVE-2024-43235.yaml

2026-11-07 08:36:19 -10:00 · 2026-08-01 12:43:27 +07:00
1 changed files with 49 additions and 0 deletions
@@ -0,0 +1,49 @@
+id: CVE-2024-43235
+
+info:
+  name: Meta Box <= 5.9.10 - Missing Authorization to Information Exposure
+  author: iamatownboy
+  severity: high
+  description: |
+    The Meta Box plugin for WordPress is vulnerable to unauthorized information exposure due to a missing capability check in the ajax_get_posts function. The function uses WP_Query's insufficient 'perm' => 'readable' parameter instead of a proper current_user_can('read_post') check. This makes it possible for authenticated attackers with Contributor-level access and above to retrieve post IDs, titles, and parent IDs for private, draft, and password-protected posts belonging to other users via the rwmb_get_posts AJAX action.
+  impact: |
+    Authenticated attackers can access sensitive post metadata including titles and IDs of private and draft posts belonging to other users, potentially exposing confidential content and internal information.
+  remediation: |
+    Update Meta Box to version 5.9.11 or later, which replaces the insufficient WP_Query perm parameter with a proper per-post current_user_can('read_post') authorization check.
+  reference:
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/meta-box/meta-box-wordpress-custom-fields-framework-5910-missing-authorization-to-information-exposure
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-43235
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
+    cvss-score: 7.1
+    cve-id: CVE-2024-43235
+    cwe-id: CWE-862
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: metabox
+    product: meta-box
+    framework: wordpress
+    publicwww-query: "/wp-content/plugins/meta-box/"
+  tags: cve,cve2024,wordpress,wp,wp-plugin,meta-box,missing-auth,info-exposure,passive
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/meta-box/readme.txt"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - contains(body, "Meta Box")
+          - compare_versions(version, "<= 5.9.10")
+        condition: and
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - '(?i)Stable tag:\s*([0-9.]+)'
+        internal: true