CVE-2021-34661

Опубликовано: 09 авг. 2021

Источник: nvd

CVSS3: 6.1

CVSS3: 4.7

CVSS2: 4.3

EPSS Низкий

Описание

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the show_logs_section function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18.

Ссылки

https://plugins.trac.wordpress.org/browser/wp-fusion-lite/trunk/includes/admin/logging/class-log-handler.php?rev=2533608#L302
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34661
Third Party Advisory
https://plugins.trac.wordpress.org/browser/wp-fusion-lite/trunk/includes/admin/logging/class-log-handler.php?rev=2533608#L302
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34661
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:verygoodplugins:wp_fusion:*:*:*:*:lite:wordpress:*:*

Версия до 3.37.18 (включая)

EPSS

Процентиль: 29%

0.00103

Низкий

6.1 Medium

CVSS3

4.7 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-7xcf-8vfw-jvw5

github

больше 3 лет назад

The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18.

EPSS

Процентиль: 29%

0.00103

Низкий

6.1 Medium

CVSS3

4.7 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352