{ "id": "CVE-2021-4417", "sourceIdentifier": "security@wordfence.com", "published": "2023-07-12T04:15:11.437", "lastModified": "2024-11-21T06:37:40.420", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { "lang": "en", "value": "The Forminator \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving_export_schedule() function. This makes it possible for unauthenticated attackers to export form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link." }, { "lang": "es", "value": "El plugin The Forminator \u2013 Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a ataques de tipo Cross-Site Request Forgery en versiones hasta la 1.13.4 inclusive. Esto es debido a la falta o incorrecta validaci\u00f3n nonce en la funci\u00f3n \"listen_for_saving_export_schedule()\". Esto hace posible que atacantes no autenticados exporten env\u00edos de formularios a trav\u00e9s de una solicitud manipulada concedida y puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace. " } ], "metrics": { "cvssMetricV31": [ { "source": "security@wordfence.com", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE" }, "exploitabilityScore": 2.8, "impactScore": 2.5 }, { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE" }, "exploitabilityScore": 2.8, "impactScore": 1.4 } ] }, "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:incsub:forminator:*:*:*:*:*:wordpress:*:*", "versionEndExcluding": "1.13.5", "matchCriteriaId": "399AF121-2EA4-4F53-8D46-63B8C528BEB7" } ] } ] } ], "references": [ { "url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/", "source": "security@wordfence.com", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/", "source": "security@wordfence.com", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/", "source": "security@wordfence.com", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/", "source": "security@wordfence.com", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/", "source": "security@wordfence.com", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/", "source": "security@wordfence.com", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/", "source": "security@wordfence.com", "tags": [ "Not Applicable" ] }, { "url": "https://plugins.trac.wordpress.org/changeset/2368977/forminator/trunk/library/class-export.php", "source": "security@wordfence.com", "tags": [ "Patch" ] }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cdee0cd8-b83b-4436-aebe-533f5af03ef1?source=cve", "source": "security@wordfence.com", "tags": [ "Third Party Advisory" ] }, { "url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Not Applicable" ] }, { "url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Not Applicable" ] }, { "url": "https://plugins.trac.wordpress.org/changeset/2368977/forminator/trunk/library/class-export.php", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch" ] }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cdee0cd8-b83b-4436-aebe-533f5af03ef1?source=cve", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ] }