CVE-2024-13606

High

Published: 13 February 2025

Published

13 February 2025

Modified

18 February 2025

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0029 52.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13606 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wiselyhub Js Help Desk. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 48.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-22 (Publicly Accessible Content).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-22 Publicly Accessible Content good match

prevent

Directly requires reviewing, restricting, and removing publicly accessible content to prevent exposure of sensitive directories like jssupportticketdata containing support ticket attachments.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation, such as patching the JS Help Desk plugin beyond version 2.8.8 to address the insecure directory storage.

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Explicitly authorizes and limits actions permitted without identification or authentication, preventing unauthenticated access to the exposed sensitive data directory.

NVD Description

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers…

to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.

Deeper analysisAI

CVE-2024-13606 is a sensitive information exposure vulnerability affecting the JS Help Desk – The Ultimate Help Desk & Support Plugin for WordPress in all versions up to and including 2.8.8. The issue stems from insecure storage of data in the /wp-content/uploads/jssupportticketdata directory, which can contain file attachments from support tickets. This flaw, classified under CWE-200, has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for privileges or user interaction.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity by directly accessing the exposed jssupportticketdata directory. Successful exploitation allows extraction of sensitive data, such as file attachments included in support tickets, potentially leading to disclosure of confidential information without affecting integrity or availability.

Advisories, including those from Wordfence, highlight the vulnerability and reference the affected code in the plugin's uploads.php file at version 2.8.8. Mitigation involves updating the plugin to a version beyond 2.8.8, where the insecure directory exposure is addressed, and reviewing uploads for any already compromised data.