← Retour aux CVEs

CVE-2021-24162

HIGH

8.8

Description

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.

Details CVE

Score CVSS v3.18.8

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie4/5/2021

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

expresstech:responsive_menu

Faiblesses (CWE)

CWE-352CWE-352

References

https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5(contact@wpscan.com)

https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/(contact@wpscan.com)

https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5(af854a3a-2127-422b-91ae-364da2661108)

https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.