Lucene search

[email protected]CVE-2021-42359

HistoryNov 05, 2021 - 9:15 p.m.

CVE-2021-42359

2021-11-0521:15:09

CWE-284

CWE-862

[email protected]

web.nvd.nist.gov

cve-2021-42359

wp dsgvo tools

gdpr

ajax action

security vulnerability

unauthenticated access

nonce check

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.2%

JSON

WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.

Affected configurations

Vulners

NVD

Node

legalwebwp_dsgvo_toolsRange3.1.23–3.1.23

VendorProductVersionCPE
legalwebwp_dsgvo_tools*cpe:2.3:a:legalweb:wp_dsgvo_tools:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
legalweb	wp_dsgvo_tools	*	cpe:2.3:a:legalweb:wp_dsgvo_tools::::::::

CNA Affected

[
  {
    "platforms": [
      "WordPress"
    ],
    "product": "WP DSGVO Tools (GDPR)",
    "vendor": "legalweb",
    "versions": [
      {
        "lessThanOrEqual": "3.1.23",
        "status": "affected",
        "version": "3.1.23",
        "versionType": "custom"
      }
    ]
  }
]