What is the CVSS score of CVE-2014-3849?

CVE-2014-3849 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. EPSS exploitation probability: 10.3%.

Is there a public PoC exploit available for CVE-2014-3849?

Yes, a public proof-of-concept exploit is available for CVE-2014-3849. Prioritise patching immediately. EPSS: 10.3%.

Imember360 CVE-2014-3849

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2014-05-23 cve@mitre.org

WordPress Privilege Escalation Imember360

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:N/I:N/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:N/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

CVE Published

May 23, 2014 - 14:55 cve.org

MEDIUM 4.3

DescriptionCVE.org

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.

AnalysisAI

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 10.3%.

Technical ContextAI

This vulnerability is classified under CWE-264. The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter. Affected products include: Imember360. Version information: through 3.9.001.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.