CVE-2021-24272

{"id": "CVE-2021-24272", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2021-05-05T19:15:08.510", "references": [{"url": "http://packetstormsecurity.com/files/164261/WordPress-Fitness-Calculators-1.9.5-Cross-Site-Request-Forgery.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/e643040b-1f3b-4c13-8a20-acfd069dcc4f", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "http://packetstormsecurity.com/files/164261/WordPress-Fitness-Calculators-1.9.5-Cross-Site-Request-Forgery.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wpscan.com/vulnerability/e643040b-1f3b-4c13-8a20-acfd069dcc4f", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue"}, {"lang": "es", "value": "El plugin de WordPress fitness calculators versiones anteriores a 1.9.6, agrega calculadoras para la ingesta de agua, la calculadora BMI, la ingesta de prote\u00ednas y la Grasa Corporal y la falta de comprobaci\u00f3n de CSRF, permite a atacantes hacer que los usuarios registrados lleven a cabo acciones no deseadas, como cambiar los encabezados de la calculadora. Debido a la falta de saneamiento, esto tambi\u00e9n podr\u00eda conllevar a un problema de tipo Stored Cross-Site Scripting almacenado"}], "lastModified": "2024-11-21T05:52:44.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:codeinitiator:fitness_calculators:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "99F5FAC1-8963-40F1-B932-CAFB05E7684D", "versionEndExcluding": "1.9.6"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}