nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-10486 CVE-2024-10486
MEDIUMNuclei
Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
Record summary
CVE-2024-10486 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.
Description
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 19, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
woocommerceBrowse automattic / woocommerceDefault status: unaffected | CVE List | Through 2.8.6 | affected |
Google for WooCommerceBrowse woocommerce / Google for WooCommerceDefault status: unaffected | CVE List | Through 2.8.6 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMGoogle for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info FileCVSS 5.3
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
Impact
Unauthenticated attackers can access PHP configuration information including server details, installed extensions, and environment variables, which can aid in planning further attacks.
Remediation
Update Google for WooCommerce plugin to version 2.8.7 or later.
WeaknessesCWE-862
Authorspopcorn94
Template tagscvecve2024wpwordpresswp-plugingoogle-listings-and-adsinfo-leakvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
https://plugins.trac.wordpress.org/browser/google-listings-and-ads/tags/2.8.6/vendor/googleads/google-ads-php/scripts/print_php_information.php https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-listings-and-ads/google-for-woocommerce-286-information-disclosure-via-publicly-accessible-php-info-file
Source: ProjectDiscovery
References
3plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/google-listings-and-ads/tags/2.8.6/vendor/googleads/google-ads-php/scripts/print_php_information.php wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/64bc7d47-6b63-4fd9-85d4-82126f86308a?source=cve