nvd-json-data-feeds/CVE-2021/CVE-2021-242xx/CVE-2021-24253.json

{
  "id": "CVE-2021-24253",
  "sourceIdentifier": "contact@wpscan.com",
  "published": "2021-05-06T13:15:11.797",
  "lastModified": "2021-05-14T18:12:07.610",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE."
    },
    {
      "lang": "es",
      "value": "El plugin de WordPress Classyfrieds versiones hasta 3.8, no comprueba apropiadamente el archivo cargado cuando un usuario autenticado agrega una lista, solo comprueba el tipo de contenido en la petici\u00f3n. Esto permite a cualquier usuario autenticado cargar archivos PHP arbitrarios por medio de la funcionalidad Add Listing del plugin, conllevando a RCE"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "contact@wpscan.com",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:classyfrieds_project:classyfrieds:*:*:*:*:*:wordpress:*:*",
              "versionEndIncluding": "3.8",
              "matchCriteriaId": "D251A002-D427-44BC-8818-4EA539DD059F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/classyfrieds.md",
      "source": "contact@wpscan.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://wpscan.com/vulnerability/ee42c233-0ff6-4b27-a5ec-ad3246bef079",
      "source": "contact@wpscan.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}