Sign-up

ID

VAR-202105-0918


CVE

CVE-2021-24195


TITLE

WordPress  for  Login as User or Customer  Authorization vulnerabilities in plugins

Trust: 0.8

sources: JVNDB: JVNDB-2021-007092

DESCRIPTION

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. WordPress for Login as User or Customer (User Switching) The plugin contains an authorization vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. WordPress is a blogging platform developed by the Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. A WordPress plugin is an open source application plugin for WordPress

Trust: 1.8

sources: NVD: CVE-2021-24195 // JVNDB: JVNDB-2021-007092 // VULHUB: VHN-382916 // VULMON: CVE-2021-24195

AFFECTED PRODUCTS

vendor:wp buymodel:login as user or customer \scope:ltversion:1.8

Trust: 1.0

vendor:wp buymodel:login as user or customerscope:eqversion: -

Trust: 0.8

vendor:wp buymodel:login as user or customerscope:eqversion:1.8

Trust: 0.8

sources: JVNDB: JVNDB-2021-007092 // NVD: CVE-2021-24195

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-24195
value: HIGH

Trust: 1.0

NVD: CVE-2021-24195
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202105-979
value: HIGH

Trust: 0.6

VULHUB: VHN-382916
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-24195
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-24195
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-382916
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-24195
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-24195
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-382916 // VULMON: CVE-2021-24195 // JVNDB: JVNDB-2021-007092 // CNNVD: CNNVD-202105-979 // NVD: CVE-2021-24195

PROBLEMTYPE DATA

problemtype:CWE-285

Trust: 1.0

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:Inappropriate authorization (CWE-285) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-007092 // NVD: CVE-2021-24195

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202105-979

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202105-979

PATCH

title:Login as User or Customer wp-buywp-buyurl:https://wordpress.org/plugins/login-as-customer-or-user/

Trust: 0.8

title:WordPress plugin Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=151797

Trust: 0.6

sources: JVNDB: JVNDB-2021-007092 // CNNVD: CNNVD-202105-979

EXTERNAL IDS

db:NVDid:CVE-2021-24195

Trust: 3.4

db:JVNDBid:JVNDB-2021-007092

Trust: 0.8

db:CNNVDid:CNNVD-202105-979

Trust: 0.6

db:VULHUBid:VHN-382916

Trust: 0.1

db:VULMONid:CVE-2021-24195

Trust: 0.1

sources: VULHUB: VHN-382916 // VULMON: CVE-2021-24195 // JVNDB: JVNDB-2021-007092 // CNNVD: CNNVD-202105-979 // NVD: CVE-2021-24195

REFERENCES

url:https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c

Trust: 2.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-24195

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/285.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-382916 // VULMON: CVE-2021-24195 // JVNDB: JVNDB-2021-007092 // CNNVD: CNNVD-202105-979 // NVD: CVE-2021-24195

SOURCES

db:VULHUBid:VHN-382916
db:VULMONid:CVE-2021-24195
db:JVNDBid:JVNDB-2021-007092
db:CNNVDid:CNNVD-202105-979
db:NVDid:CVE-2021-24195

LAST UPDATE DATE

2024-08-14T14:18:30.921000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-382916date:2022-07-30T00:00:00
db:VULMONid:CVE-2021-24195date:2021-05-24T00:00:00
db:JVNDBid:JVNDB-2021-007092date:2022-02-02T09:08:00
db:CNNVDid:CNNVD-202105-979date:2022-08-10T00:00:00
db:NVDid:CVE-2021-24195date:2022-07-30T12:33:24.737

SOURCES RELEASE DATE

db:VULHUBid:VHN-382916date:2021-05-14T00:00:00
db:VULMONid:CVE-2021-24195date:2021-05-14T00:00:00
db:JVNDBid:JVNDB-2021-007092date:2022-02-02T00:00:00
db:CNNVDid:CNNVD-202105-979date:2021-05-14T00:00:00
db:NVDid:CVE-2021-24195date:2021-05-14T12:15:08.123