Search
Find a vulnerability
Search criteria
2 vulnerabilities found for cloudflare by cloudflare
CVE-2024-0212 (GCVE-0-2024-0212)
Vulnerability from nvd – Published: 2024-01-29 09:13 – Updated: 2025-06-06 17:40
VLAI
Title
Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)
Summary
The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - Improper Access Control
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/cloudflare/Cloudflare-WordPres… | vendor-advisory |
| https://github.com/cloudflare/Cloudflare-WordPres… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cloudflare | Cloudflare-WordPress |
Affected:
0 , ≤ 4.12.2
(patch)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T17:41:16.185Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-07T20:23:05.888917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-06T17:40:11.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Cloudflare-WordPress",
"platforms": [
"Wordpress"
],
"product": "Cloudflare-WordPress",
"repo": "https://github.com/cloudflare/Cloudflare-WordPress",
"vendor": "Cloudflare",
"versions": [
{
"changes": [
{
"at": "4.12.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.12.2",
"status": "affected",
"version": "0",
"versionType": "patch"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "lucius0101 (HackerOne Researcher)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.\u003cbr\u003e"
}
],
"value": "The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-29T09:13:44.939Z",
"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
"shortName": "cloudflare"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
"assignerShortName": "cloudflare",
"cveId": "CVE-2024-0212",
"datePublished": "2024-01-29T09:13:44.939Z",
"dateReserved": "2024-01-03T09:08:21.334Z",
"dateUpdated": "2025-06-06T17:40:11.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0212 (GCVE-0-2024-0212)
Vulnerability from cvelistv5 – Published: 2024-01-29 09:13 – Updated: 2025-06-06 17:40
VLAI
Title
Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)
Summary
The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - Improper Access Control
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/cloudflare/Cloudflare-WordPres… | vendor-advisory |
| https://github.com/cloudflare/Cloudflare-WordPres… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cloudflare | Cloudflare-WordPress |
Affected:
0 , ≤ 4.12.2
(patch)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T17:41:16.185Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-07T20:23:05.888917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-06T17:40:11.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Cloudflare-WordPress",
"platforms": [
"Wordpress"
],
"product": "Cloudflare-WordPress",
"repo": "https://github.com/cloudflare/Cloudflare-WordPress",
"vendor": "Cloudflare",
"versions": [
{
"changes": [
{
"at": "4.12.3",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.12.2",
"status": "affected",
"version": "0",
"versionType": "patch"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "lucius0101 (HackerOne Researcher)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.\u003cbr\u003e"
}
],
"value": "The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-29T09:13:44.939Z",
"orgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
"shortName": "cloudflare"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "a22f1246-ba21-4bb4-a601-ad51614c1513",
"assignerShortName": "cloudflare",
"cveId": "CVE-2024-0212",
"datePublished": "2024-01-29T09:13:44.939Z",
"dateReserved": "2024-01-03T09:08:21.334Z",
"dateUpdated": "2025-06-06T17:40:11.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}