CVE-2021-24284

{"id": "CVE-2021-24284", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-05-14T12:15:08.387", "references": [{"url": "http://packetstormsecurity.com/files/167743/WordPress-Kaswara-Modern-WPBakery-Page-Builder-3.0.1-File-Upload.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "contact@wpscan.com"}, {"url": "https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477", "tags": ["Product", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "http://packetstormsecurity.com/files/167743/WordPress-Kaswara-Modern-WPBakery-Page-Builder-3.0.1-File-Upload.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477", "tags": ["Product", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP."}, {"lang": "es", "value": "El plugin de WordPress Kaswara Modern VC Addons versiones hasta 3.0.1, permite la carga de archivos arbitrarios no autenticados mediante la acci\u00f3n AJAX \"uploadFontIcon\". El archivo zip proporcionado est\u00e1 siendo descomprimido en el directorio wp-content/uploads/kaswara/fonts_icon sin comprobaci\u00f3n de archivos maliciosos como PHP"}], "lastModified": "2024-11-21T05:52:45.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kaswara_project:kaswara:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "8B9EF5A0-624E-4C09-8DB5-8DD87CFF3FFA", "versionEndIncluding": "3.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}