CVE-2021-24717

{"id": "CVE-2021-24717", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-11-01T09:15:08.900", "references": [{"url": "https://wpscan.com/vulnerability/5916ea42-eb33-463d-8528-2a142805c91f", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/5916ea42-eb33-463d-8528-2a142805c91f", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions."}, {"lang": "es", "value": "El plugin AutomatorWP de WordPress versiones anteriores a 1.7.6, no realiza comprobaciones de capacidad, que permite a usuarios con roles de suscriptor enumerar automatizaciones, revelar el t\u00edtulo de las publicaciones privadas o los correos electr\u00f3nicos de los usuarios, llamar a funciones o llevar a cabo una escalada de privilegios por medio de acciones Ajax"}], "lastModified": "2024-11-21T05:53:37.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:automatorwp:automatorwp:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "AF491AA0-0236-44CF-978B-65C865BACDE8", "versionEndExcluding": "1.7.6"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}