Lucene search

WPScanCVE-2021-24165

HistoryApr 05, 2021 - 7:15 p.m.

CVE-2021-24165

2021-04-0519:15:15

CWE-601

WPScan

web.nvd.nist.gov

cve-2021-24165

ninja forms

contact form

wordpress plugin

open redirect

security vulnerability

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

48.0%

JSON

In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.

Affected configurations

Nvd

Vulners

Node

ninjaformsninja_formsRange<3.4.34wordpress

VendorProductVersionCPE
ninjaformsninja_forms*cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
ninjaforms	ninja_forms	*	cpe:2.3:a:ninjaforms:ninja_forms::::::wordpress::*

CNA Affected

[
  {
    "product": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.4.34",
        "status": "affected",
        "version": "3.4.34",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818

www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

48.0%

JSON

Related for CVE-2021-24165