← Voltar para CVEs

CVE-2021-24224

HIGH

8.8

Descricao

The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado4/12/2021

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

easy-form-builder-by-bitware_project:easy-form-builder-by-bitware

Fraquezas (CWE)

CWE-434

Referencias

https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Builder.md(contact@wpscan.com)

https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484(contact@wpscan.com)

https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Builder.md(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.