CVE-2021-24579

The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://wpscan.com/vulnerability/08edce3f-2746-4886-8439-76e44ec76fa8	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bold-themes:bold_page_builder:*:*:*:*:*:wordpress:*:*

History

02 Sep 2021, 15:26

Type	Values Removed	Values Added
CPE		cpe:2.3:a:bold-themes:bold_page_builder::::::wordpress::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.5 v3 : 8.8
References	~~(MISC) https://wpscan.com/vulnerability/08edce3f-2746-4886-8439-76e44ec76fa8 -~~	(MISC) https://wpscan.com/vulnerability/08edce3f-2746-4886-8439-76e44ec76fa8 - Exploit, Third Party Advisory

30 Aug 2021, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-08-30 15:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-24579

Mitre link : CVE-2021-24579

CVE.ORG link : CVE-2021-24579

JSON object : View

Products Affected

bold-themes

bold_page_builder

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2021-24579", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-08-30T15:15:07.557", "references": [{"url": "https://wpscan.com/vulnerability/08edce3f-2746-4886-8439-76e44ec76fa8", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases."}, {"lang": "es", "value": "La acci\u00f3n bt_bb_get_grid AJAX del plugin de WordPress Bold Page Builder versiones anteriores a 3.1.6, pasa la entrada del usuario a la funci\u00f3n unserialize() sin ninguna comprobaci\u00f3n o saneamiento, lo que podr\u00eda conllevar a una Inyecci\u00f3n de Objeto PHP. Aunque el plugin no conten\u00eda un gadget adecuado para explotar completamente el problema, otros plugins instalados en el blog podr\u00edan permitir que este problema sea explotado y conllevar a un RCE en algunos casos."}], "lastModified": "2021-09-02T15:26:05.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bold-themes:bold_page_builder:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "A741BDE2-46E2-46E2-ACB1-FB342079CCC4", "versionEndExcluding": "3.1.6"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}