CVE-2024-10855: Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion
First published: Wed Nov 20 2024(Updated: )
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirv_upload_file_by_chunks() function and lack of in all versions up to, and including, 7.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sirv CDN | <7.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ec09e5-4994-4d23-bf8e-26b64d5303fa?source=cve
- https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.8/sirv.php#L4691
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3186406%40sirv&new=3186406%40sirv&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-10855?
CVE-2024-10855 has a high severity rating due to its potential to cause denial of service and unauthorized data modification.
How do I fix CVE-2024-10855?
To fix CVE-2024-10855, update the Sirv plugin for WordPress to the latest version beyond 7.3.1 that addresses this vulnerability.
What are the potential impacts of CVE-2024-10855?
The potential impacts of CVE-2024-10855 include unauthorized data modification and a denial of service that can disrupt website functionality.
Which versions are affected by CVE-2024-10855?
All versions of the Sirv plugin for WordPress prior to version 7.3.2 are affected by CVE-2024-10855.
Is there a workaround for CVE-2024-10855?
Currently, there are no specific workarounds for CVE-2024-10855, and upgrading the plugin is recommended.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/remedy
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sirv
- canonical/sirv cdn