Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-24752
HistoryOct 18, 2021 - 2:15 p.m.

CVE-2021-24752

2021-10-1814:15:10
CWE-284
CWE-352
[email protected]
web.nvd.nist.gov
2
catchthemes
wordpress plugins
configuration change
csrf vulnerability
ajax action
cve-2021-24752

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.2%

JSON

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4’s configurations.

Affected configurations

Nvd
Node
catchpluginscatch_scroll_progress_barRange<1.6wordpress
OR
catchpluginscatch_sticky_menuRange<1.7wordpress
OR
catchpluginscatch_themes_demo_importRange<1.6wordpress
OR
catchpluginscatch_under_constructionRange<1.4wordpress
OR
catchpluginscatch_web_toolsRange<2.7wordpress
OR
catchpluginsessential_content_typesRange<1.9wordpress
OR
catchpluginsessential_widgetsRange<1.9wordpress
OR
catchpluginsgenerate_child_themeRange<1.6wordpress
OR
catchpluginsheader_enhancementRange<1.5wordpress
OR
catchpluginsto_topRange<2.3wordpress
VendorProductVersionCPE
catchpluginscatch_scroll_progress_bar*cpe:2.3:a:catchplugins:catch_scroll_progress_bar:*:*:*:*:*:wordpress:*:*
catchpluginscatch_sticky_menu*cpe:2.3:a:catchplugins:catch_sticky_menu:*:*:*:*:*:wordpress:*:*
catchpluginscatch_themes_demo_import*cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:*
catchpluginscatch_under_construction*cpe:2.3:a:catchplugins:catch_under_construction:*:*:*:*:*:wordpress:*:*
catchpluginscatch_web_tools*cpe:2.3:a:catchplugins:catch_web_tools:*:*:*:*:*:wordpress:*:*
catchpluginsessential_content_types*cpe:2.3:a:catchplugins:essential_content_types:*:*:*:*:*:wordpress:*:*
catchpluginsessential_widgets*cpe:2.3:a:catchplugins:essential_widgets:*:*:*:*:*:wordpress:*:*
catchpluginsgenerate_child_theme*cpe:2.3:a:catchplugins:generate_child_theme:*:*:*:*:*:wordpress:*:*
catchpluginsheader_enhancement*cpe:2.3:a:catchplugins:header_enhancement:*:*:*:*:*:wordpress:*:*
catchpluginsto_top*cpe:2.3:a:catchplugins:to_top:*:*:*:*:*:wordpress:*:*

Related

cvelist 1
patchstack 17
wpvulndb 1
prion 1
wpexploit 1
cve 1
cvelist
cvelist
CVE-2021-24752 Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change
2021-10-18 13:46:10
patchstack
patchstack
WordPress Catch Infinite Scroll plugin <= 1.8.1 - Unauthorized Plugin Setting Change vulnerability
2021-09-19 00:00:00
WordPress Catch Import Export plugin <= 1.8 - Unauthorized Plugin Setting Change vulnerability
2021-09-20 00:00:00
WordPress Catch Scroll Progress Bar plugin <= 1.5 - Unauthorized Plugin Setting Change vulnerability
2021-09-20 00:00:00
wpvulndb
wpvulndb
Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change
2021-09-20 00:00:00
prion
prion
Cross site request forgery (csrf)
2021-10-18 14:15:00
wpexploit
wpexploit
Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change
2021-09-20 00:00:00
cve
cve
CVE-2021-24752
2021-10-18 14:15:10

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.2%

JSON
Related for NVD:CVE-2021-24752
cvelist1patchstack17wpvulndb1prion1wpexploit1cve1