exploitDog

CVE-2021-24380

Опубликовано: 16 авг. 2021

Источник: nvd

CVSS3: 4.3

CVSS2: 4.3

EPSS Низкий

Описание

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

Ссылки

https://wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a925-605822739000
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a925-605822739000
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:shantz_wordpress_qotd_project:shantz_wordpress_qotd:*:*:*:*:*:wordpress:*:*

Версия до 1.2.2 (включая)

EPSS

Процентиль: 29%

0.00103

Низкий

4.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

CWE-352

Связанные уязвимости

GHSA-cqhr-j9fp-qjmw

github

больше 3 лет назад

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

EPSS

Процентиль: 29%

0.00103

Низкий

4.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

CWE-352