CVE-2021-24993

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/2650578	Patch Third Party Advisory
https://wpscan.com/vulnerability/514416fa-d915-4953-bf1b-6dbf40b4d7e5	Exploit Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2650578	Patch Third Party Advisory
https://wpscan.com/vulnerability/514416fa-d915-4953-bf1b-6dbf40b4d7e5	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:etoilewebdesign:ultimate_product_catalog:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2022-02-07 16:15

Updated : 2024-11-21 05:54

NVD link : CVE-2021-24993

Mitre link : CVE-2021-24993

CVE.ORG link : CVE-2021-24993

JSON object : View

Products Affected

etoilewebdesign

ultimate_product_catalog

CWE

CWE-862

Missing Authorization

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2021-24993", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-02-07T16:15:43.710", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/2650578", "tags": ["Patch", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/514416fa-d915-4953-bf1b-6dbf40b4d7e5", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/2650578", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wpscan.com/vulnerability/514416fa-d915-4953-bf1b-6dbf40b4d7e5", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example"}, {"lang": "es", "value": "El plugin Ultimate Product Catalog de WordPress versiones anteriores a 5.0.26 no presenta comprobaciones de autorizaci\u00f3n y de tipo CSRF en algunas acciones AJAX, lo que podr\u00eda permitir a cualquier usuario autenticado, como el suscriptor, llamarlas y a\u00f1adir productos arbitrarios, o cambiar la configuraci\u00f3n del plugin, por ejemplo"}], "lastModified": "2024-11-21T05:54:09.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:etoilewebdesign:ultimate_product_catalog:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "6EFEDE98-7B60-492F-ABB2-7C52C4974D71", "versionEndExcluding": "5.0.26"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}