Lucene search

WPScanCVE-2021-24328

HistoryJun 01, 2021 - 2:15 p.m.

CVE-2021-24328

2021-06-0114:15:09

CWE-352

CWE-79

WPScan

web.nvd.nist.gov

cve-2021-24328

wp login security

history wordpress plugin

csrf

xss

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N

EPSS

0.002

Percentile

64.6%

JSON

The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin’s settings to arbitrary values, and set XSS payloads on them as well

Affected configurations

Nvd

Vulners

Node

clogicawp_login_security_and_historyRange≤1.0wordpress

VendorProductVersionCPE
clogicawp_login_security_and_history*cpe:2.3:a:clogica:wp_login_security_and_history:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
clogica	wp_login_security_and_history	*	cpe:2.3:a:clogica:wp_login_security_and_history::::::wordpress::*

CNA Affected

[
  {
    "product": "WP Login Security and History",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.0",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  }
]

References

m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.html

m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt

m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt

wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4ace

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N

EPSS

0.002

Percentile

64.6%

JSON

Related for CVE-2021-24328