CVE-2024-3729
Published: 02 May 2024
Summary
CVE-2024-3729 is a critical-severity Failing Open (CWE-636) vulnerability in Dynamiapps Frontend Admin. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 27.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32303
Vulnerability details
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing…
more
forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Supports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it.
Entering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state.
Directly requires transition to a known (secure) state on failure, preventing fail-open behavior.
Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open.
Failed verification tests trigger alerts, reducing the window for exploitation when systems fail open.
Ensures audit logging continues on primary failure instead of failing open with no logging capability.
Ensures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails.
Training ensures users perform required checks for unusual or exceptional conditions as part of contingency roles, limiting attacker leverage from skipped validations.