CVE-2024-13552: SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to download attachments for support tickets that don't belong to them. If an admin enables tickets for guests, this can be exploited by unauthenticated attackers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13552?
The severity of CVE-2024-13552 is considered to be high due to its potential for unauthorized access through insecure direct object reference.
How do I fix CVE-2024-13552?
To fix CVE-2024-13552, update the SupportCandy – Helpdesk & Customer Support Ticket System plugin to version 3.3.1 or later.
Who is affected by CVE-2024-13552?
All users of the SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress who are using versions up to and including 3.3.0 are affected by CVE-2024-13552.
What can attackers do with CVE-2024-13552?
Attackers can exploit CVE-2024-13552 to manipulate file uploads and gain unauthorized access to sensitive information.
Is CVE-2024-13552 a zero-day vulnerability?
No, CVE-2024-13552 is not a zero-day vulnerability as it has been publicly disclosed and patches are available.