CVE-2024-6554: Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure
First published: Thu Jul 11 2024(Updated: )
The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WPMU DEV Branda | <3.4.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a79eb25-a7d1-4102-97e6-8fa8db9ed03e?source=cve
- https://plugins.trac.wordpress.org/browser/branda-white-labeling/trunk/misc/composer/prefix-fixer.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3115603%40branda-white-labeling&new=3115603%40branda-white-labeling&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-6554?
CVE-2024-6554 has a severity rating that indicates a potential risk of information exposure through Full Path Disclosure.
How do I fix CVE-2024-6554?
To fix CVE-2024-6554, update the Branda plugin to version 3.4.19 or later.
What is Full Path Disclosure in CVE-2024-6554?
Full Path Disclosure in CVE-2024-6554 allows attackers to access sensitive file paths in the server, leading to potential data exposure.
Which versions of the Branda plugin are affected by CVE-2024-6554?
All versions of the Branda plugin up to and including 3.4.18 are affected by CVE-2024-6554.
Who is the vendor for the affected software in CVE-2024-6554?
The vendor for the affected software in CVE-2024-6554 is WPMU DEV.
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wpmudev
- canonical/wpmu dev branda