CVE-2021-24238

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

EPSS 1.1%CWE-284

Vexday Risk Score

3Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS —EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 abr 2021Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.

Productos afectados

PureThemes · Findeo PureThemes · Realteo

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Findeo-WordPress-Theme-v1.3.0.txt https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Realteo-WordPress-Plugin-v1.2.3.txt https://wpscan.com/vulnerability/b8434eb2-f522-484f-9227-5f581e7f48a5 https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/