ByteOS Network

Vulnerability Details :

CVE-2024-54366

Assigner Org ID-21595511-bba5-4825-b968-b78d1f9984a3

Published At-16 Dec, 2024 | 14:13

Updated At-16 Dec, 2024 | 16:40

WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in Dave Kiss Vimeography allows Retrieve Embedded Sensitive Data.This issue affects Vimeography: from n/a through 2.4.4.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Patchstack

Assigner Org ID:21595511-bba5-4825-b968-b78d1f9984a3

Published At:16 Dec, 2024 | 14:13

Updated At:16 Dec, 2024 | 16:40

▼CVE Numbering Authority (CNA)

WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in Dave Kiss Vimeography allows Retrieve Embedded Sensitive Data.This issue affects Vimeography: from n/a through 2.4.4.

Affected Products

Vendor

Dave Kiss

Product

Vimeography

Collection URL

https://wordpress.org/plugins

Package Name

vimeography

Default Status

unaffected

Versions

Affected

From n/a through 2.4.4 (custom)
- -> unaffectedfrom2.4.5

Problem Types

Type	CWE ID	Description
CWE	CWE-209	CWE-209 Generation of Error Message Containing Sensitive Information

Type: CWE

CWE ID: CWE-209

Description: CWE-209 Generation of Error Message Containing Sensitive Information

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impacts

CAPEC ID	Description
CAPEC-37	CAPEC-37 Retrieve Embedded Sensitive Data

CAPEC ID: CAPEC-37

Description: CAPEC-37 Retrieve Embedded Sensitive Data

Solutions

Update the WordPress Vimeography plugin to the latest available version (at least 2.4.5).

Credits

finder

Fariq Fadillah Gusti Insani (Patchstack Alliance)

References

Hyperlink	Resource
https://patchstack.com/database/wordpress/plugin/vimeography/vulnerability/wordpress-vimeography-plugin-2-4-4-full-path-disclosure-fpd-vulnerability?_s_id=cve	vdb-entry

Hyperlink: https://patchstack.com/database/wordpress/plugin/vimeography/vulnerability/wordpress-vimeography-plugin-2-4-4-full-path-disclosure-fpd-vulnerability?_s_id=cve

Resource:

vdb-entry

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:audit@patchstack.com

Published At:16 Dec, 2024 | 15:15

Updated At:16 Dec, 2024 | 15:15

Generation of Error Message Containing Sensitive Information vulnerability in Dave Kiss Vimeography allows Retrieve Embedded Sensitive Data.This issue affects Vimeography: from n/a through 2.4.4.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE ID	Type	Source
CWE-209	Primary	audit@patchstack.com

CWE ID: CWE-209

Type: Primary

Source: audit@patchstack.com

References

Hyperlink	Source	Resource
https://patchstack.com/database/wordpress/plugin/vimeography/vulnerability/wordpress-vimeography-plugin-2-4-4-full-path-disclosure-fpd-vulnerability?_s_id=cve	audit@patchstack.com	N/A

Hyperlink: https://patchstack.com/database/wordpress/plugin/vimeography/vulnerability/wordpress-vimeography-plugin-2-4-4-full-path-disclosure-fpd-vulnerability?_s_id=cve

Source: audit@patchstack.com

Resource: N/A

Similar CVEs

157Records found

CVE-2021-20428

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.18% / 39.57%

7 Day CHG~0.00%

Published-24 May, 2021 | 13:55

Updated-16 Sep, 2024 | 20:26

IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196315.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel security_guardium Security Guardium

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-20289

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-5.3||MEDIUM

EPSS-0.08% / 25.26%

7 Day CHG~0.00%

Published-26 Mar, 2021 | 16:28

Updated-03 Aug, 2024 | 17:37

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.

Vendor-quarkus n/a Red Hat, Inc.NetApp, Inc.Oracle Corporation

Product-resteasy quarkus oncommand_insight communications_cloud_native_core_console resteasy

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2021-20430

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.16% / 37.04%

7 Day CHG~0.00%

Published-26 Jul, 2021 | 12:10

Updated-16 Sep, 2024 | 20:02

IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows i2_analyze linux_kernel i2 Analyze

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2020-4628

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.18% / 39.57%

7 Day CHG~0.00%

Published-27 Jan, 2021 | 13:05

Updated-16 Sep, 2024 | 20:22

IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.

Vendor-IBM Corporation

Product-cloud_pak_for_security Cloud Pak for Security

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2020-4599

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.19% / 40.60%

7 Day CHG~0.00%

Published-13 Jan, 2021 | 18:10

Updated-16 Sep, 2024 | 22:46

IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184824.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-security_guardium_insights linux_kernel Security Guardium Insights

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2020-35177

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.40% / 59.55%

7 Day CHG~0.00%

Published-17 Dec, 2020 | 04:17

Updated-04 Aug, 2024 | 17:02

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

Vendor-n/a HashiCorp, Inc.

Product-vault n/a

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2019-6792

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.26% / 49.63%

7 Day CHG~0.00%

Published-09 Sep, 2019 | 19:37

Updated-04 Aug, 2024 | 20:31

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display instance internal information.

Vendor-n/a GitLab Inc.

Product-gitlab n/a

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

CVE-2024-54366

Credits

WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs