CVE-2021-24238

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

EPSS 1.1%CWE-284

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 abr 2021Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.

Produtos afetados

PureThemes · Findeo PureThemes · Realteo

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Findeo-WordPress-Theme-v1.3.0.txt https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Realteo-WordPress-Plugin-v1.2.3.txt https://wpscan.com/vulnerability/b8434eb2-f522-484f-9227-5f581e7f48a5 https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/