CVE-2024-6568 affects the Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress, specifically versions up to and including 3.1.0. This vulnerability, categorized as Full Path Disclosure (CWE-200), allows unauthenticated attackers to retrieve the full path of the web application due to improper handling of mobiledetect files. The vulnerability has a CVSS score of 5.3 (Medium), indicating a low impact on confidentiality and no impact on integrity or availability. Its attack vector is network-based with low attack complexity, requiring no user interaction or privileges. While the disclosed information itself is not directly damaging, it can be used to aid other, more significant attacks. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low awareness and a lack of widespread attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Flamix | Flamix: Bitrix24 And Contact Form 7 Integrations | >= 0, <= 3.1.0CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.