9.8

CVE-2021-24284

Exploit

Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload

Kaswara Modern VC Addons <= 3.0.1 - Arbitrary File Upload

The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
Mögliche Gegenmaßnahme
Kaswara Modern VC Addons: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kaswara Project ≫ Kaswara SwPlatformwordpress Version <= 3.0.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Kaswara Modern VC Addons
Version *-3.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 42.14% 0.985
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

http://packetstormsecurity.com/files/167743/WordPress-Kaswara-Modern-WPBakery-Page-Builder-3.0.1-File-Upload.html
Third Party Advisory
Exploit
VDB Entry
https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477
Third Party Advisory
Product
https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2c6030-d117-4c0b-a97a-d0bb89e948ef
Third Party Advisory