CVE-2021-24222

WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE

EPSS 2.4%CWE-434

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 2.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

12 abr 2021Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.

Produtos afetados

Unknown · WP-Curriculo Vitae Free

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900