{"id":1636,"date":"2025-04-25T07:33:29","date_gmt":"2025-04-25T07:33:29","guid":{"rendered":"http:\/\/localhost\/?p=1636"},"modified":"2025-04-25T07:33:29","modified_gmt":"2025-04-25T07:33:29","slug":"cve-2024-11917-jobsearch-wp-job-board-288-authentication-bypass-via-social-logins","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=1636","title":{"rendered":"CVE-2024-11917 JobSearch WP Job Board <= 2.8.8 - Authentication Bypass via Social Logins"},"content":{"rendered":"
\n

Vulnerability Details<\/h2>\n
\n

Basic Information<\/h3>\n\n\n\n\n\n\n
Title<\/th>\nCVE-2024-11917 JobSearch WP Job Board <= 2.8.8 - Authentication Bypass via Social Logins<\/td>\n<\/tr>\n
Type<\/th>\ncvelist<\/td>\n<\/tr>\n
Published<\/th>\n2025-04-25T11:12:52<\/td>\n<\/tr>\n
Last Seen<\/th>\n2025-04-25T11:37:21<\/td>\n<\/tr>\n
CVSS Score<\/th>\n8.1 (HIGH)<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVSS v3 Details<\/h3>\n\n\n\n\n\n\n\n\n\n
Attack Vector<\/th>\nNETWORK<\/td>\n<\/tr>\n
Attack Complexity<\/th>\nHIGH<\/td>\n<\/tr>\n
Privileges Required<\/th>\nNONE<\/td>\n<\/tr>\n
User Interaction<\/th>\nNONE<\/td>\n<\/tr>\n
Scope<\/th>\nUNCHANGED<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\nHIGH<\/td>\n<\/tr>\n
Integrity Impact<\/th>\nHIGH<\/td>\n<\/tr>\n
Availability Impact<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVE Information<\/h3>\n\n\n\n\n
CVE IDs<\/th>\nCVE-2024-11917<\/td>\n<\/tr>\n
CWE<\/th>\nCWE-287<\/td>\n<\/tr>\n
Bulletin Family<\/th>\ncve<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

Description<\/h3>\n
\n The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.8. This is due to improper configurations in the ‘jobsearch_xing_response_data_callback’, ‘set_access_tokes’, and ‘google_callback’ functions. This makes it possible for unauthenticated attackers to log in as the first connected Xing user, or any connected Xing user if the Xing id is known. It is also possible for unauthenticated attackers to log in as the first connected Google user if the user has logged in, without subsequently logging out, in thirty days. The vulnerability was partially patched in version 2.8.4.\n <\/div>\n<\/p><\/div>\n
\n

Impact Assessment<\/h3>\n\n\n\n
Base Score<\/th>\n8.1<\/td>\n<\/tr>\n
Severity<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

View full CVE details<\/a><\/p>\n<\/p><\/div>\n<\/div>\n