CVE-2021-4330

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contributor-lever permissions and above to upload arbitrary files and potentially gain remote code execution in versions up to and including 1.0.13 of Template Kit – Import and versions up to and including 2.0.10 of Envato Elements & Download.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2617529%40envato-elements&new=2617529%40envato-elements&sfp_email=&sfph_mail=	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/68fe17e2-d5ab-4ebd-a5c6-d65cea327abd	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:envato:envato_elements::::::wordpress::*
	cpe:2.3:a:envato:template_kit_-_import::::::wordpress::*

History

07 Nov 2023, 03:40

Type	Values Removed	Values Added
CWE	~~CWE-434~~

Information

Published : 2023-03-07 14:15

Updated : 2024-02-28 19:51

NVD link : CVE-2021-4330

Mitre link : CVE-2021-4330

CVE.ORG link : CVE-2021-4330

JSON object : View

Products Affected

envato

template_kit_-_import
envato_elements

CWE

No CWE.

{"id": "CVE-2021-4330", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-03-07T14:15:09.627", "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2617529%40envato-elements&new=2617529%40envato-elements&sfp_email=&sfph_mail=", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/68fe17e2-d5ab-4ebd-a5c6-d65cea327abd", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Modified", "descriptions": [{"lang": "en", "value": "The Envato Elements & Download and Template Kit \u2013 Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contributor-lever permissions and above to upload arbitrary files and potentially gain remote code execution in versions up to and including 1.0.13 of Template Kit \u2013 Import and versions up to and including 2.0.10 of Envato Elements & Download."}], "lastModified": "2023-11-07T03:40:42.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envato:envato_elements:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "49DB71CD-B22F-48B1-8EEF-618CC1B1CC0B", "versionEndIncluding": "2.0.10"}, {"criteria": "cpe:2.3:a:envato:template_kit_-_import:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "1ADBA4EF-11D8-48B2-A5E3-90BAA464573C", "versionEndIncluding": "1.0.13"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}