Lucene search

WPScanCVE-2021-24484

HistoryAug 02, 2021 - 11:15 a.m.

CVE-2021-24484

2021-08-0211:15:10

CWE-89

WPScan

web.nvd.nist.gov

cve-2021-24484

secure copy

content protection

content locking

wordpress plugin

sql injection

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.7%

JSON

The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Affected configurations

Nvd

Vulners

Node

ays-prosecure_copy_content_protection_and_content_lockingRange<2.6.7wordpress

VendorProductVersionCPE
ays-prosecure_copy_content_protection_and_content_locking*cpe:2.3:a:ays-pro:secure_copy_content_protection_and_content_locking:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
ays-pro	secure_copy_content_protection_and_content_locking	*	cpe:2.3:a:ays-pro:secure_copy_content_protection_and_content_locking::::::wordpress::*

CNA Affected

[
  {
    "product": "Secure Copy Content Protection and Content Locking",
    "vendor": "Ays Pro",
    "versions": [
      {
        "lessThan": "2.6.7",
        "status": "affected",
        "version": "2.6.7",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/9ce0153d-4a8b-4215-b6b6-15ca68c4f52c

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.7%

JSON

Related for CVE-2021-24484