Vulnerabilities > CVE-2024-43322 - Authorization Bypass Through User-Controlled Key vulnerability in Zephyr-One Zephyr Project Manager

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

zephyr-one

CWE-639

critical

NVD

Published: 2024-08-18

Updated: 2025-02-11

Summary

Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.

Vulnerable Configurations

Part	Description	Count
Application	Zephyr-One Zephyr ONE Zephyr Project Manager - Zephyr ONE Zephyr Project Manager 2.8.0 Zephyr ONE Zephyr Project Manager 2.79.0 Zephyr ONE Zephyr Project Manager 2.81.0 Zephyr ONE Zephyr Project Manager 2.82.0 Zephyr ONE Zephyr Project Manager 2.83.0 Zephyr ONE Zephyr Project Manager 2.84.0 Zephyr ONE Zephyr Project Manager 2.85.0 Zephyr ONE Zephyr Project Manager 2.86.0 Zephyr ONE Zephyr Project Manager 2.87.0 Zephyr ONE Zephyr Project Manager 2.88.0 Zephyr ONE Zephyr Project Manager 2.89.0 Zephyr ONE Zephyr Project Manager 2.90.0 Zephyr ONE Zephyr Project Manager 2.91.0 Zephyr ONE Zephyr Project Manager 2.92.0 Zephyr ONE Zephyr Project Manager 2.93.0 Zephyr ONE Zephyr Project Manager 2.94.0 Zephyr ONE Zephyr Project Manager 2.95.0 Zephyr ONE Zephyr Project Manager 3.0.0 Zephyr ONE Zephyr Project Manager 3.0.1 Zephyr ONE Zephyr Project Manager 3.2.0 Zephyr ONE Zephyr Project Manager 3.2.01 Zephyr ONE Zephyr Project Manager 3.2.1 Zephyr ONE Zephyr Project Manager 3.2.5 Zephyr ONE Zephyr Project Manager 3.2.31 Zephyr ONE Zephyr Project Manager 3.2.41 Zephyr ONE Zephyr Project Manager 3.2.42 Zephyr ONE Zephyr Project Manager 3.2.52 Zephyr ONE Zephyr Project Manager 3.2.53 Zephyr ONE Zephyr Project Manager 3.2.54 Zephyr ONE Zephyr Project Manager 3.2.55 Zephyr ONE Zephyr Project Manager 3.2.61 Zephyr ONE Zephyr Project Manager 3.3.0 Zephyr ONE Zephyr Project Manager 3.3.1 Zephyr ONE Zephyr Project Manager 3.3.2 Zephyr ONE Zephyr Project Manager 3.3.3 Zephyr ONE Zephyr Project Manager 3.3.4 Zephyr ONE Zephyr Project Manager 3.3.5 Zephyr ONE Zephyr Project Manager 3.3.6 Zephyr ONE Zephyr Project Manager 3.3.7 Zephyr ONE Zephyr Project Manager 3.3.8 Zephyr ONE Zephyr Project Manager 3.3.9 Zephyr ONE Zephyr Project Manager 3.3.52 Zephyr ONE Zephyr Project Manager 3.3.53 Zephyr ONE Zephyr Project Manager 3.3.54 Zephyr ONE Zephyr Project Manager 3.3.55 Zephyr ONE Zephyr Project Manager 3.3.56 Zephyr ONE Zephyr Project Manager 3.3.57 Zephyr ONE Zephyr Project Manager 3.3.58 Zephyr ONE Zephyr Project Manager 3.3.59 Zephyr ONE Zephyr Project Manager 3.3.61 Zephyr ONE Zephyr Project Manager 3.3.62 Zephyr ONE Zephyr Project Manager 3.3.63 Zephyr ONE Zephyr Project Manager 3.3.64 Zephyr ONE Zephyr Project Manager 3.3.66 Zephyr ONE Zephyr Project Manager 3.3.67 Zephyr ONE Zephyr Project Manager 3.3.68 Zephyr ONE Zephyr Project Manager 3.3.69 Zephyr ONE Zephyr Project Manager 3.3.91 Zephyr ONE Zephyr Project Manager 3.3.93 Zephyr ONE Zephyr Project Manager 3.3.94 Zephyr ONE Zephyr Project Manager 3.3.95 Zephyr ONE Zephyr Project Manager 3.3.100	63

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

References

https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-100-insecure-direct-object-references-idor-vulnerability?_s_id=cve