CVE-2021-24804

HIGH

8.8

Beschreibung

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht11/17/2021

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

simple_jwt_login_project:simple_jwt_login

Schwachen (CWE)

CWE-352

Referenzen

https://wpscan.com/vulnerability/6f015e8e-462b-4ef7-a9a1-bb91e7d28e37(contact@wpscan.com)

https://wpscan.com/vulnerability/6f015e8e-462b-4ef7-a9a1-bb91e7d28e37(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.