Lucene search

WPScanCVE-2021-24913

HistoryFeb 28, 2022 - 9:15 a.m.

CVE-2021-24913

2022-02-2809:15:08

CWE-352

WPScan

web.nvd.nist.gov

cve-2021-24913

logo showcase

slick slider

wordpress plugin

csrf

ajax

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.

Affected configurations

Nvd

Vulners

Node

infornweblogo_showcase_with_slick_sliderRange<2.0.1wordpress

VendorProductVersionCPE
infornweblogo_showcase_with_slick_slider*cpe:2.3:a:infornweb:logo_showcase_with_slick_slider:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
infornweb	logo_showcase_with_slick_slider	*	cpe:2.3:a:infornweb:logo_showcase_with_slick_slider::::::wordpress::*

CNA Affected

[
  {
    "product": "Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.0.1",
        "status": "affected",
        "version": "2.0.1",
        "versionType": "custom"
      }
    ]
  }
]

References

plugins.trac.wordpress.org/changeset/2669404

wpscan.com/vulnerability/2f499945-1924-49f0-ad6e-9192273a5c05

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

Related for CVE-2021-24913