Lucene search

[email protected]NVD:CVE-2021-24816

HistoryNov 08, 2021 - 6:15 p.m.

CVE-2021-24816

2021-11-0818:15:10

CWE-284

[email protected]

web.nvd.nist.gov

phoenix media rename

unauthorized access

media files

capability checks

ajax action

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own.

Affected configurations

Nvd

Node

phoenix_media_rename_projectphoenix_media_renameRange<3.4.4wordpress

VendorProductVersionCPE
phoenix_media_rename_projectphoenix_media_rename*cpe:2.3:a:phoenix_media_rename_project:phoenix_media_rename:*:*:*:*:*:wordpress:*:*