CVE-2021-24668

Опубликовано: 23 нояб. 2021

Источник: nvd

CVSS3: 4.3

CVSS2: 4.3

EPSS Низкий

Описание

The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack

Ссылки

https://wpscan.com/vulnerability/519205ff-2ff6-41e4-9e95-475ab2ce35b9
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/519205ff-2ff6-41e4-9e95-475ab2ce35b9
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:feataholic:maz_loader:*:*:*:*:*:wordpress:*:*

Версия до 1.4.1 (исключая)

EPSS

Процентиль: 29%

0.00103

Низкий

4.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-8crm-4582-5p48

CVSS3: 4.3

github

почти 4 года назад

The MAZ Loader WordPress plugin through 1.3.4 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack

EPSS

Процентиль: 29%

0.00103

Низкий

4.3 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352