CVE-2021-24696

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe	Exploit Third Party Advisory
https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tipsandtricks-hq:simple_download_monitor:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 05:53

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe - Exploit, Third Party Advisory

Information

Published : 2022-01-24 08:15

Updated : 2024-11-21 05:53

NVD link : CVE-2021-24696

Mitre link : CVE-2021-24696

CVE.ORG link : CVE-2021-24696

JSON object : View

Products Affected

tipsandtricks-hq

simple_download_monitor

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2021-24696", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-01-24T08:15:08.560", "references": [{"url": "https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads"}, {"lang": "es", "value": "El plugin Simple Download Monitor de WordPress versiones anteriores a 3.9.9, no aplica las comprobaciones de nonce, lo que podr\u00eda permitir a atacantes llevar a cabo ataques de tipo CSRF para 1) hacer que los administradores exporten los registros para explotar una vulnerabilidad de divulgaci\u00f3n de registros independiente (corregida en versi\u00f3n 3.9.6), 2) eliminar los registros (corregida en versi\u00f3n 3.9.9), 3) eliminar la imagen en miniatura de las descargas"}], "lastModified": "2024-11-21T05:53:35.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tipsandtricks-hq:simple_download_monitor:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "9931EFF1-2017-45D1-80B4-E90C6210DF13", "versionEndExcluding": "3.9.9"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}