Към съдържанието
Търсене

CVE-2021-24752: CatchThemes Essential Widgets, заобикаляне на вход и

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

CVE радар: още уязвимости от този вид

    Описание

    Оригинално описание

    Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.

    Засегнати продукти

    • CatchThemes Essential Widgets: 1.9 преди 1.9
    • CatchThemes To Top: 2.3 преди 2.3
    • CatchThemes Header Enhancement: 1.5 преди 1.5
    • CatchThemes Generate Child Theme: 1.6 преди 1.6
    • CatchThemes Essential Content Types: 1.9 преди 1.9
    • CatchThemes Catch Web Tools: 2.7 преди 2.7
    • CatchThemes Catch Under Construction: 1.4 преди 1.4
    • CatchThemes Catch Themes Demo Import: 1.6 преди 1.6
    • CatchThemes Catch Sticky Menu: 1.7 преди 1.7
    • CatchThemes Catch Scroll Progress Bar: 1.6 преди 1.6
    • CatchThemes Social Gallery and Widget: 2.3 преди 2.3
    • CatchThemes Catch Infinite Scroll: 1.9 преди 1.9
    • CatchThemes Catch Import Export: 1.9 преди 1.9
    • CatchThemes Catch Gallery: 1.7 преди 1.7
    • CatchThemes Catch Duplicate Switcher: 1.6 преди 1.6
    • CatchThemes Catch Breadcrumb: 1.7 преди 1.7
    • CatchThemes Catch IDs: 2.4 преди 2.4

    Вид слабост

    История

    • 18 октомври 2021 Публикувано

    Други уязвимости в CatchThemes Essential Widgets

    Първоизточници

    CVE-2021-24752: CatchThemes Essential Widgets, заобикаляне на вход и | freedomonline.bg