CVE-2021-24730

🗓️ 28 Feb 2022 09:06:07Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 90 Views🌐 WEB

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 allows authenticated users to modify media details

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin Logo Showcase with Slick Slider 访问控制错误漏洞	28 Feb 202200:00	–	cnnvd
Cvelist	CVE-2021-24730 Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update	28 Feb 202209:06	–	cvelist
EUVD	EUVD-2021-11642	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24730	28 Feb 202209:15	–	nvd
Patchstack	WordPress Logo Showcase with Slick Slider plugin <= 1.2.4 - Arbitrary Media Title/Description/Alt Text/URL Update vulnerability	24 Oct 202100:00	–	patchstack
Prion	Cross site request forgery (csrf)	28 Feb 202209:15	–	prion
Positive Technologies	PT-2022-9454 · WordPress · The Logo Showcase With Slick Slider	28 Feb 202200:00	–	ptsecurity
RedhatCVE	CVE-2021-24730	22 May 202519:23	–	redhatcve
wpexploit	Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update	24 Oct 202100:00	–	wpexploit
WPVulnDB	Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update	24 Oct 202100:00	–	wpvulndb

NVD

Vulners

Node

infornweb logo_showcase_with_slick_sliderRange<1.2.5wordpress

[
  {
    "product": "Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.2.5",
        "status": "affected",
        "version": "1.2.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/d5534ff9-c4af-46b7-8852-0f3dfd644855

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	AJAX action lswss_save_attachment_data allows authenticated users to modify media metadata (title, description, alt text, and URL) without CSRF/authorization checks.	CWE-352, CWE-862
attachment_id	request body	/wp-admin/admin-ajax.php	AJAX action lswss_save_attachment_data allows authenticated users to modify media metadata (title, description, alt text, and URL) without CSRF/authorization checks.	CWE-352, CWE-862
form_data	request body	/wp-admin/admin-ajax.php	AJAX action lswss_save_attachment_data allows authenticated users to modify media metadata (title, description, alt text, and URL) without CSRF/authorization checks.	CWE-352, CWE-862

21 Nov 2024 05:53Current

4.6Medium risk

Vulners AI Score4.6

CVSS 24

CVSS 3.14.3

EPSS0.00095