Platform
wordpress
Component
barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
Fixed in
1.5.4
CVE-2024-33567 identifies a Privilege Escalation vulnerability within the UkrSolution Barcode Scanner with Inventory & Order Manager. This flaw allows unauthorized users to elevate their privileges, potentially gaining control over the system. The vulnerability impacts versions up to 1.5.3, and a patch is available in version 1.5.4.
Successful exploitation of CVE-2024-33567 could grant an attacker complete control over the affected Barcode Scanner with Inventory & Order Manager instance. This includes the ability to modify inventory data, manipulate orders, and potentially access sensitive information stored within the system. Depending on the system's configuration and network connectivity, this could lead to broader lateral movement within the network, impacting other connected systems and data. The CRITICAL CVSS score reflects the high likelihood of exploitation and the significant potential impact.
CVE-2024-33567 was publicly disclosed on 2024-05-17. As of this writing, there are no publicly available proof-of-concept exploits. The vulnerability's severity and ease of exploitation warrant careful monitoring. Its inclusion in WordPress environments increases the potential attack surface. The EPSS score is likely to be medium, reflecting the potential for exploitation given the privilege escalation nature of the vulnerability.
Exploit Status
EPSS
0.74% (73% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-33567 is to immediately upgrade the Barcode Scanner with Inventory & Order Manager to version 1.5.4 or later. If upgrading is not immediately feasible, consider implementing stricter access controls and privilege separation within the application. Review user permissions and ensure that only authorized personnel have access to sensitive functions. While a direct WAF rule is unlikely, monitoring for unusual privilege escalation attempts within the application logs is recommended. After upgrading, verify the fix by attempting to execute commands or access resources with a low-privilege user account and confirming that access is denied.
Actualice el plugin Barcode Scanner with Inventory & Order Manager a la última versión disponible. La vulnerabilidad de escalada de privilegios no autenticada se ha corregido en versiones posteriores a la 1.5.3. Consulte el registro de cambios del plugin para obtener más detalles sobre la corrección.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-33567 is a CRITICAL vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager allowing attackers to gain elevated privileges.
You are affected if you are using Barcode Scanner with Inventory & Order Manager version 1.5.3 or earlier.
Upgrade to version 1.5.4 or later to remediate the vulnerability. Implement stricter access controls as an interim measure.
There are currently no publicly known active exploits, but the vulnerability's severity warrants monitoring.
Refer to the UkrSolution website or WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.