← Volver a CVEs

CVE-2021-24224

HIGH

8.8

Descripcion

The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado4/12/2021

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

easy-form-builder-by-bitware_project:easy-form-builder-by-bitware

Debilidades (CWE)

CWE-434

Referencias

https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Builder.md(contact@wpscan.com)

https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484(contact@wpscan.com)

https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Builder.md(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.