Lucene search

WPScanCVE-2021-24809

HistoryNov 01, 2021 - 9:15 a.m.

CVE-2021-24809

2021-11-0109:15:09

CWE-352

WPScan

web.nvd.nist.gov

cve-2021-24809

bp better messages

wordpress plugin

csrf

ajax actions

security vulnerability

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions

Affected configurations

Nvd

Vulners

Node

wordplusbetter_messagesRange<1.9.9.41wordpress

VendorProductVersionCPE
wordplusbetter_messages*cpe:2.3:a:wordplus:better_messages:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wordplus	better_messages	*	cpe:2.3:a:wordplus:better_messages::::::wordpress::*

CNA Affected

[
  {
    "product": "BP Better Messages",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.9.9.41",
        "status": "affected",
        "version": "1.9.9.41",
        "versionType": "custom"
      }
    ]
  }
]

References

plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/inc/ajax.php

wpscan.com/vulnerability/e186fef4-dca0-461f-b539-082c13a68d13

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

47.5%

JSON

Related for CVE-2021-24809