5.5
CVE-2021-24842
- EPSS 0.15%
- Veröffentlicht 29.11.2021 09:15:07
- Zuletzt bearbeitet 21.11.2024 05:53:52
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginBulk Datetime Change <= 1.11 - Missing Authorisation
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
Mögliche Gegenmaßnahme
Bulk Datetime Change: Update to version 1.12, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Bulk Datetime Change
Version
[*, 1.12)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bulk Datetime Change Project ≫ Bulk Datetime Change SwPlatformwordpress Version < 1.12
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.356 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
|
| nvd@nist.gov | 5.5 | 8 | 4.9 |
AV:N/AC:L/Au:S/C:P/I:P/A:N
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.