CVE-2024-0235
Published: 16 January 2024
Summary
CVE-2024-0235 is a medium-severity Missing Authorization (CWE-862) vulnerability in Myeventon Eventon. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The EventON WordPress plugin, in versions prior to 4.5.5 and 2.2.7, is affected by a missing authorization vulnerability (CWE-862) in an AJAX action. This flaw allows unauthenticated access to retrieve email addresses of any users registered on the site, corresponding to a CVSS 3.1 score of 5.3 reflecting limited impact on confidentiality without requiring authentication or user interaction.
Unauthenticated remote attackers can directly invoke the unprotected AJAX endpoint to enumerate and extract user email addresses from the WordPress installation. This information disclosure can support further attacks such as targeted phishing or credential-stuffing campaigns against site users.
The WPScan advisories for this issue identify the root cause in the plugin's authorization checks and state that the vulnerability is resolved by updating to EventON 4.5.5 or 2.2.7. Site administrators are advised to apply the patched versions to eliminate the exposed endpoint. The associated EPSS score remains elevated near its peak of 0.8732.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16033
Vulnerability details
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.