CVE-2021-3120

{"id": "CVE-2021-3120", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-02-22T15:15:13.367", "references": [{"url": "https://github.com/guy-liu/yith-giftdrop", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://yithemes.com/themes/plugins/yith-woocommerce-gift-cards/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/guy-liu/yith-giftdrop", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://yithemes.com/themes/plugins/yith-woocommerce-gift-cards/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even though the intention was to only allow uploads of Gift Card images."}, {"lang": "es", "value": "Una vulnerabilidad de carga de archivos arbitraria en el plugin YITH WooCommerce Gift Cards Premium versiones anteriores a 3.3.1, para WordPress, permite a atacantes remotos lograr una ejecuci\u00f3n de c\u00f3digo remota en el sistema operativo en el contexto de seguridad del servidor web. A fin de explotar esta vulnerabilidad, un atacante debe poder colocar una Tarjeta de Regalo v\u00e1lida en el carrito de compras. Un archivo cargado se coloca en una ruta predeterminada en el servidor web con un nombre de archivo y una extensi\u00f3n especificados por el usuario. Esto ocurre porque el par\u00e1metro ywgc-upload-picture puede tener un valor .php aunque la intenci\u00f3n era permitir solo la carga de im\u00e1genes de Tarjetas de Regalo"}], "lastModified": "2024-11-21T06:20:55.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yithemes:yith_woocommerce_gift_cards:*:*:*:*:premium:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "8F1E3219-DBAC-446E-9631-6EF41D9DA346", "versionEndExcluding": "3.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}