CVE-2021-24881

The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071	Exploit Third Party Advisory
https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:passster_project:passter:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 05:53

Type	Values Removed	Values Added
Summary		(es) El complemento Passster de WordPress anterior a 3.5.5.9 no verifica correctamente la contraseña, ni tampoco que la publicación que se va a ver sea pública, lo que permite a los usuarios no autenticados omitir la protección ofrecida por el complemento y acceder a publicaciones arbitrarias (como contenido privado), enviando una solicitud específicamente manipulada.
References	~~() https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071 - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071 - Exploit, Third Party Advisory

26 Jun 2023, 17:47

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-01-23 15:15

Updated : 2025-04-02 16:15

NVD link : CVE-2021-24881

Mitre link : CVE-2021-24881

CVE.ORG link : CVE-2021-24881

JSON object : View

Products Affected

passster_project

passter

CWE

NVD-CWE-Other

{"id": "CVE-2021-24881", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-01-23T15:15:13.147", "references": [{"url": "https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request."}, {"lang": "es", "value": "El complemento Passster de WordPress anterior a 3.5.5.9 no verifica correctamente la contrase\u00f1a, ni tampoco que la publicaci\u00f3n que se va a ver sea p\u00fablica, lo que permite a los usuarios no autenticados omitir la protecci\u00f3n ofrecida por el complemento y acceder a publicaciones arbitrarias (como contenido privado), enviando una solicitud espec\u00edficamente manipulada."}], "lastModified": "2025-04-02T16:15:16.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:passster_project:passter:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "C8291B1F-F495-482A-9F4B-2BD044641893", "versionEndExcluding": "3.5.5.9"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}

7.5 /10