CVE-2021-24307

🗓️ 24 May 2021 10:58:05Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 148 Views🌐 WEB

The All in One SEO plugin before 4.1.0.2 allows authenticated users to execute arbitrary code

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-24307	3 Jan 202206:42	–	circl
CNNVD	WordPress plugin All in One SEO Pack 代码问题漏洞	24 May 202100:00	–	cnnvd
CNVD	WordPress Code Injection Vulnerability	25 May 202100:00	–	cnvd
Cvelist	CVE-2021-24307 All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize	24 May 202110:58	–	cvelist
GithubExploit	Exploit for Deserialization of Untrusted Data in Aioseo All_In_One_Seo	2 Jan 202207:50	–	githubexploit
NVD	CVE-2021-24307	24 May 202111:15	–	nvd
OpenVAS	WordPress All in One SEO Pack Plugin < 4.1.0.2 RCE Vulnerability	29 Jun 202100:00	–	openvas
Patchstack	WordPress All In One SEO Pack plugin <= 4.1.0.1 - Authenticated Remote Code Execution (RCE) vulnerability	9 May 202100:00	–	patchstack
Prion	Design/Logic Flaw	24 May 202111:15	–	prion
RedhatCVE	CVE-2021-24307	22 May 202521:04	–	redhatcve

NVD

Vulners

Node

aioseo all_in_one_seoRange<4.1.0.2wordpress

[
  {
    "product": "All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings",
    "vendor": "All in One SEO Team",
    "versions": [
      {
        "lessThan": "4.1.0.2",
        "status": "affected",
        "version": "4.1.0.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/ab2c94d2-f6c4-418b-bd14-711ed164bcf1
aioseo	www.aioseo.com/changelog/

Parameter	Position	Path	Description	CWE
file	binary	index.php/wp-json/aioseo/v1/settings/import/	Authenticated RCE via crafted ini upload to AIOSEO Import/Export endpoint (unserialize of .ini + Monolog gadget enables code execution).	CWE-502

21 Nov 2024 05:52Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

CVSS 29

EPSS0.41776

CWE-502