CVE-2021-20866

Опубликовано: 13 дек. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.

Ссылки

https://jvn.jp/en/jp/JVN09136401/index.html
Third Party Advisory
https://wordpress.org/plugins/advanced-custom-fields/
Third Party Advisory
https://www.advancedcustomfields.com/
Vendor Advisory
https://jvn.jp/en/jp/JVN09136401/index.html
Third Party Advisory
https://wordpress.org/plugins/advanced-custom-fields/
Third Party Advisory
https://www.advancedcustomfields.com/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:*:wordpress:*:*

Версия до 5.11 (исключая)

cpe:2.3:a:advancedcustomfields:advanced_custom_fields:*:*:*:*:pro:wordpress:*:*

Версия до 5.11 (исключая)

EPSS

Процентиль: 78%

0.01159

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-gcpg-c569-xfr4

github

около 4 лет назад