CVE-2021-36891

🗓️ 15 Jun 2022 19:16:58Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 74 Views🌐 WEB

Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugi

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin Photo Gallery 跨站请求伪造漏洞	15 Jun 202200:00	–	cnnvd
CNVD	WordPress Photo Gallery plugin跨站请求伪造漏洞	17 Jun 202200:00	–	cnvd
Cvelist	CVE-2021-36891 WordPress Photo Gallery by Supsystic plugin <= 1.15.5 - Cross-Site Request Forgery (CSRF) leading to Plugin Settings Change	15 Jun 202219:16	–	cvelist
EUVD	EUVD-2021-23467	7 Oct 202500:30	–	euvd
NVD	CVE-2021-36891	15 Jun 202220:15	–	nvd
Patchstack	WordPress Photo Gallery by Supsystic plugin <= 1.15.5 - Cross-Site Request Forgery (CSRF) leading to Plugin Settings Change	15 Jun 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	15 Jun 202220:15	–	prion
Vulnrichment	CVE-2021-36891 WordPress Photo Gallery by Supsystic plugin <= 1.15.5 - Cross-Site Request Forgery (CSRF) leading to Plugin Settings Change	15 Jun 202219:16	–	vulnrichment
wpexploit	Photo Gallery by Supsystic < 1.15.6 - Arbitrary Settings Update via CSRF	15 Jun 202200:00	–	wpexploit
WPVulnDB	Photo Gallery by Supsystic < 1.15.6 - Arbitrary Settings Update via CSRF	15 Jun 202200:00	–	wpvulndb

NVD

Vulners

Node

supsystic photo_galleryRange<1.15.6wordpress

[
  {
    "product": "Photo Gallery by Supsystic (WordPress plugin)",
    "vendor": "Supsystic",
    "versions": [
      {
        "lessThanOrEqual": "1.15.5",
        "status": "affected",
        "version": "<= 1.15.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/vulnerability/gallery-by-supsystic/wordpress-photo-gallery-by-supsystic-plugin-1-15-5-cross-site-request-forgery-csrf-leading-to-plugin-settings-change
wordpress	www.wordpress.org/plugins/gallery-by-supsystic/

Parameter	Position	Path	Description	CWE
settings[send_stats]	request body	/wp-admin/admin.php?page=supsystic-gallery&module=settings&action=saveSettings	CSRF vulnerability allows an attacker to change plugin settings via a forged request	CWE-352
settings[image_editor]	request body	/wp-admin/admin.php?page=supsystic-gallery&module=settings&action=saveSettings	CSRF vulnerability allows an attacker to change plugin settings via a forged request	CWE-352