Lucene search
Till KrüssWPEX-ID:8E3E89FD-E380-4108-BE23-00E87FBAAD16HistoryMar 26, 2021 - 12:00 a.m.
AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage
2021-03-2600:00:00
Till Krüss
443
0.026 Low
EPSS
Percentile
90.4%
In the plugin, the file “resource/frontend/product/product-shortcode.php” responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required. AccessAlly 3.5.7 resolved the issue.
curl -s https://example.com | grep '<div id="accessally-testing-data"'Related
nuclei
nuclei
AccessAlly <3.5.7 - Sensitive Information Leakage
2021-09-28 16:56:37
prion
prion
Design/Logic Flaw
2021-04-12 14:15:00
cvelist
cvelist
CVE-2021-24226 AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage
2021-04-12 14:04:46
nvd
nvd
CVE-2021-24226
2021-04-12 14:15:15
patchstack
patchstack
wpvulndb
wpvulndb
AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage
2021-03-26 00:00:00
cve
cve
CVE-2021-24226
2021-04-12 14:15:15