8.8

CVE-2021-24162

Exploit

Responsive Menu <= 4.0.3 - Cross-Site Request Forgery to Setting Modification

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.
Mögliche Gegenmaßnahme
Responsive Menu – Create Mobile-Friendly Menu: Update to version 4.0.4, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Responsive Menu – Create Mobile-Friendly Menu
Version [*, 4.0.4)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Expresstech ≫ Responsive Menu SwEditionfree SwPlatformwordpress Version < 4.0.4
Expresstech ≫ Responsive Menu SwEditionpro SwPlatformwordpress Version < 4.0.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.314
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.