Lucene search

[email protected]NVD:CVE-2021-4364

HistoryJun 07, 2023 - 2:15 a.m.

CVE-2021-4364

2023-06-0702:15:14

CWE-862

[email protected]

web.nvd.nist.gov

jobsearch plugin

wordpress

authenticated attackers

authorization bypass

schedule calls

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

36.6%

JSON

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls.

Affected configurations

Nvd

Node

eyecixjobsearch_wp_job_boardRange≤1.8.1wordpress

VendorProductVersionCPE
eyecixjobsearch_wp_job_board*cpe:2.3:a:eyecix:jobsearch_wp_job_board:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
eyecix	jobsearch_wp_job_board	*	cpe:2.3:a:eyecix:jobsearch_wp_job_board::::::wordpress::*

References

blog.nintechnet.com/wordpress-jobsearch-wp-job-board-plugin-fixed-vulnerability/

wpscan.com/vulnerability/7e2dd5df-f758-419c-bfb8-b8e53235fede

www.wordfence.com/threat-intel/vulnerabilities/id/9114018f-0678-4973-bb1e-932f0d93f963?source=cve

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

36.6%

JSON

Related for NVD:CVE-2021-4364

prion1 cve1 cvelist1