Lucene search

WPScanCVE-2021-24215

HistoryApr 12, 2021 - 2:15 p.m.

CVE-2021-24215

2021-04-1214:15:15

CWE-425

CWE-284

WPScan

web.nvd.nist.gov

cve-2021-24215

improper access control

vulnerability

wordpress plugin

controlled admin access

uncontrolled access

website customization

global cms settings

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.275

Percentile

96.9%

JSON

An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.

Affected configurations

Nvd

Vulners

Node

wprubycontrolled_admin_accessRange<1.5.2wordpress

VendorProductVersionCPE
wprubycontrolled_admin_access*cpe:2.3:a:wpruby:controlled_admin_access:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpruby	controlled_admin_access	*	cpe:2.3:a:wpruby:controlled_admin_access::::::wordpress::*

CNA Affected

[
  {
    "product": "Controlled Admin Access",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.2",
        "status": "affected",
        "version": "1.5.2",
        "versionType": "custom"
      }
    ]
  }
]

References

m0ze.ru/vulnerability/%5B2021-03-18%5D-%5BWordPress%5D-%5BCWE-284%5D-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt

wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.275

Percentile

96.9%

JSON

Related for CVE-2021-24215