Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbWpvulndbWPVDB-ID:E690B887-DE5F-4950-BEDF-4A9F5FE9B773
HistorySep 01, 2021 - 12:00 a.m.

Gutenberg Template Library & Redux Framework < 4.2.13 - Contributor+ Arbitrary Plugin Installation and Post Deletion

2021-09-0100:00:00
wpscan.com
5

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

JSON

The plugin did not correctly check the authorisation in the redux/v1/templates/ REST API namespace, allowing any users with the edit_posts capability (ie contributor and above) to call the endpoints define in it. By using the redux/v1/templates/plugin-install one, they could install plugins from the WordPres repository, or delete arbitrary posts/pages via redux/v1/templates/delete_saved_block

CPENameOperatorVersion
redux-frameworklt4.2.13

Related

osv 1
cnvd 1
prion 1
cve 1
wpvulndb 1
wordfence 1
threatpost 1
openvas 1
patchstack 1
wpexploit 1
osv
osv
CVE-2021-38312
2021-09-02 17:15:00
cnvd
cnvd
WordPress Gutenberg Template Library
2021-09-04 00:00:00
prion
prion
Authorization
2021-09-02 17:15:00
cve
cve
CVE-2021-38312
2021-09-02 17:15:00
wpvulndb
wpvulndb
WP Mail Logging < 1.10.0 - Outdated Redux Framework
2021-11-29 00:00:00
wordfence
wordfence
Over 1 Million Sites Affected by Gutenberg Template Library & Redux Framework Vulnerabilities
2021-09-01 14:13:37
threatpost
threatpost
Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites
2021-09-01 17:58:38
openvas
openvas
WordPress Gutenberg Template Library & Redux Framework Plugin < 4.2.13 Multiple Vulnerabilities
2021-09-30 00:00:00
patchstack
patchstack
WordPress WP Mail Logging plugin <= 1.9.9 - Using Components with Known Vulnerabilities (vulnerable Redux Framework version)
2021-11-29 00:00:00
wpexploit
wpexploit
WP Mail Logging < 1.10.0 - Outdated Redux Framework
2021-11-29 00:00:00

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

JSON
Related for WPVDB-ID:E690B887-DE5F-4950-BEDF-4A9F5FE9B773
osv1cnvd1prion1cve1wpvulndb1wordfence1threatpost1openvas1patchstack1wpexploit1