Lucene search

Shreya Pohekar (Code Vigilant Project)PATCHSTACK:3DAB30129D988A766AAAFFBFA8DD56F2

HistoryJun 29, 2021 - 12:00 a.m.

WordPress RSVPMaker plugin <= 8.7.2 - Authenticated Server-Side Request Forgery (SSRF) vulnerability

2021-06-2900:00:00

Shreya Pohekar (Code Vigilant Project)

patchstack.com

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

JSON

Authenticated Server-Side Request Forgery (SSRF) vulnerability discovered by Shreya Pohekar in WordPress RSVPMaker plugin (versions <= 8.7.2).

Solution

           Update the WordPress RSVPMaker plugin to the latest available version (at least 8.7.3).

CPENameOperatorVersion
rsvpmarkerle8.7.2

CPE	Name	Operator	Version
	rsvpmarker	le	8.7.2

References

codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24371

wordpress.org/plugins/rsvpmaker/#developers

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

JSON

Related for PATCHSTACK:3DAB30129D988A766AAAFFBFA8DD56F2