CVE-2024-37451
Published: 02 January 2025
Description
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Travel Agency travel-agency allows Cross Site Request Forgery.This issue affects Travel Agency: from n/a through <= 1.4.9.
Security Summary
CVE-2024-37451 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Travel Agency WordPress theme developed by Rara Theme. This issue affects the Travel Agency theme from unknown initial versions through version 1.4.9.
The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Attackers can exploit it remotely over the network with low attack complexity and no required privileges, though it demands user interaction, such as visiting a malicious site. Exploitation enables low-impact integrity modifications, allowing unauthorized actions to be performed on behalf of authenticated users who interact with forged requests.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/travel-agency/vulnerability/wordpress-travel-agency-theme-1-4-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve documents the CSRF vulnerability in Travel Agency theme version 1.4.9 and provides details for mitigation.
Details
- CWE(s)