CVE-2024-0595: Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()

Q: What is the severity of CVE-2024-0595?

CVE-2024-0595 is considered a medium severity vulnerability due to its potential for unauthorized access.

Q: How do I fix CVE-2024-0595?

To fix CVE-2024-0595, update the Awesome Support plugin to version 6.1.8 or later.

Q: Who is affected by CVE-2024-0595?

CVE-2024-0595 affects all versions of the Awesome Support plugin for WordPress up to and including 6.1.7.

Q: What type of vulnerability is CVE-2024-0595?

CVE-2024-0595 is an unauthorized access vulnerability arising from a missing capability check.

Q: What can attackers do with CVE-2024-0595?

Attackers can exploit CVE-2024-0595 to gain unauthorized access to the user data through the wpas_get_users() function.

Published Feb 10, 2024

Updated

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpasgetusers() function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve user data such as emails. CVE-2024-35741 is likely a duplicate of this issue.

Affected Software

1 affected component

Getawesomesupport Awesome Support Wordpress<6.1.8

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033134%40awesome-support&new=3033134%40awesome-support&sfp_email=&sfph_mail=

Event History

Feb 10, 2024

CVE Published

via MITRE·06:51 AM

Data Sourced

via MITRE·06:51 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-0595?

CVE-2024-0595 is considered a medium severity vulnerability due to its potential for unauthorized access.

How do I fix CVE-2024-0595?