CVE-2024-9627 in TeploBot Plugin

Sumário

de MITRE • 22/10/2024

The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'service_process' function in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to view the Telegram Bot Token, which is a secret token to control the bot.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Reservar: 08/10/2024
• Divulgação: 22/10/2024
• Moderação: aceite
• Entrada: VDB-281470
• CPE: pronto
• CWE: CWE-200 (confirmado)
• CVSS: 7.3 (NVD)
• EPSS: 0.00351
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2024-9627
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-9627
• CVE Details: https://www.cvedetails.com/cve/CVE-2024-9627/