CVE-2024-3246 LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

What is CVE-2024-3246?

CVE-2024-3246 is a medium-severity vulnerability in litespeedtech LiteSpeed Cache, published on 24 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2024-3246?

It affects 1 product.

Products include Litespeedtech Litespeed Cache.

How do I fix CVE-2024-3246?

No fix has been published for CVE-2024-3246 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-3246 being exploited?

There is no known exploitation of CVE-2024-3246 in the wild and no public exploit code.

Other vulnerabilities in litespeedtech LiteSpeed Cache

• CVE-2024-44000 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability Critical 9.8
• CVE-2024-28000 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability Critical 9.8
• CVE-2024-47637 WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability High 8.8
• CVE-2023-40000 WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability High 8.3
• CVE-2023-45000 WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x7jc-6q36-2744.