CVE-2023-38389CWE-863

WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability

Critical · published June 21, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

🚨 An incorrect authorization issue in Artbees JupiterX Core could unleash a world of chaos, allowing unauthorized access to sensitive functions that should be locked down tight! 🔥 Imagine a hotel where the front desk accidentally gives out master keys to every room — guests can stroll into any suite, rummaging through valuables without a care. That’s exactly what’s happening here with the access control mechanisms failing to keep unauthorized users out. The consequences are absolutely devastating! An attacker could exploit this vulnerability to gain access to restricted functionality, potentially allowing them to alter settings, view sensitive data, or manipulate the entire site. It’s like handing over the keys to your digital kingdom without realizing it!

Put simply

Imagine a hotel where the front desk accidentally gives out master keys to every room — guests can stroll into any suite, rummaging through valuables without a care. That’s exactly what’s happening here with the access control mechanisms failing to keep unauthorized users out. This incorrect authorization vulnerability in JupiterX Core allows users to access functionalities that aren't properly constrained by Access Control Lists (ACLs), enabling unauthorized actions without proper authentication checks.

What to do

The consequences are absolutely devastating! An attacker could exploit this vulnerability to gain access to restricted functionality, potentially allowing them to alter settings, view sensitive data, or manipulate the entire site. It’s like handing over the keys to your digital kingdom without realizing it! Immediate action is critical! Update your JupiterX Core to version 3.3.9 or later to patch this vulnerability. Additionally, review your ACL configurations to ensure that sensitive actions are adequately protected. Don't wait — secure your site now! You've got this! Follow these steps and you’ll lock down your site in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01406 · 72.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-06-21T15:58Z
EPSS history
Timeline
  • 21 JUN 15:58Z
    WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerability
    cvelistv5