CVE-2024-3629 HL Twitter <= 2014.1.18 - Settings Update via CSRF

Q: What is CVE-2024-3629?

CVE-2024-3629 is a low-severity vulnerability in Unknown HL Twitter, published on 15 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Q: Is CVE-2024-3629 being exploited?

There is no known exploitation of CVE-2024-3629 in the wild and no public exploit code.

Q: How do I fix CVE-2024-3629?

No fix has been published for CVE-2024-3629 yet. Limit exposure of the affected software until one is available.

Low 2.4 Published 15 May 2024 Updated 20 Nov 2024

Attackers can force logged-in administrators to modify HL Twitter plugin settings via CSRF, requiring an upgrade to the latest version.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-3629?

CVE-2024-3629 is a low-severity vulnerability in Unknown HL Twitter, published on 15 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Weakness: CWE-352

Which versions are affected by CVE-2024-3629?

It affects 1 product.

Products include Dachande663 Hl Twitter.

How do I fix CVE-2024-3629?

No fix has been published for CVE-2024-3629 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-3629 being exploited?

There is no known exploitation of CVE-2024-3629 in the wild and no public exploit code.

Sources

Also known as GHSA-p3vp-jg8v-gfmh.