5.3
CVE-2021-4353
- EPSS 0.29%
- Veröffentlicht 20.10.2023 07:15:14
- Zuletzt bearbeitet 21.11.2024 06:37:29
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginWooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.
Mögliche Gegenmaßnahme
WooCommerce Dynamic Pricing and Discounts: Update to version 2.4.2, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WooCommerce Dynamic Pricing and Discounts
Version
[*, 2.4.2)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rightpress ≫ Woocommerce Dynamic Pricing & Discounts SwPlatformwordpress Version < 2.4.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.29% | 0.517 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| security@wordfence.com | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.