4.3

CVE-2021-24806

Exploit

wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF

Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery

The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.
Mögliche Gegenmaßnahme
Comments – wpDiscuz: Update to version 7.3.4, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gvectors ≫ Wpdiscuz SwPlatformwordpress Version < 7.3.4
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Comments – wpDiscuz
Version [*, 7.3.4)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.368
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://wpscan.com/vulnerability/2746101e-e993-42b9-bd6f-dfd5544fa3fe
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/e641453c-8fa0-4b44-b912-b797aeae1795
Third Party Advisory