CVE-2021-24602

HIGH

8.8

Descripcion

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado8/23/2021

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

hmplugin:hm_multiple_roles

Debilidades (CWE)

CWE-269CWE-669

Referencias

https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/(contact@wpscan.com)

https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5(contact@wpscan.com)

https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.