CVE-2021-24371 (GCVE-0-2021-24371)

Vulnerability from cvelistv5 – Published: 2021-08-02 10:31 – Updated: 2024-08-03 19:28
VLAI?
Title
RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF
Summary
The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.
Severity ?
No CVSS data available.
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
Unknown RSVPMaker Affected: 8.7.3 , < 8.7.3 (custom)
Create a notification for this product.
Credits
Shreya Pohekar of Codevigilant Project
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:28:23.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RSVPMaker",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "8.7.3",
              "status": "affected",
              "version": "8.7.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shreya Pohekar of Codevigilant Project"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it\u0027s a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-02T10:31:53",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RSVPMaker \u003c 8.7.3 - Authenticated (admin+) SSRF",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24371",
          "STATE": "PUBLIC",
          "TITLE": "RSVPMaker \u003c 8.7.3 - Authenticated (admin+) SSRF"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "RSVPMaker",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "8.7.3",
                            "version_value": "8.7.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Shreya Pohekar of Codevigilant Project"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it\u0027s a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-918 Server-Side Request Forgery (SSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d"
            },
            {
              "name": "https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/",
              "refsource": "MISC",
              "url": "https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24371",
    "datePublished": "2021-08-02T10:31:53",
    "dateReserved": "2021-01-14T00:00:00",
    "dateUpdated": "2024-08-03T19:28:23.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"8.7.3\", \"matchCriteriaId\": \"BFB474F8-B7BD-4735-A452-2FC6E4736282\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it\u0027s a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.\"}, {\"lang\": \"es\", \"value\": \"La funcionalidad Import del plugin RSVPMaker de WordPress versiones anteriores a 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) toma una entrada de URL y llama a curl sobre ella, sin comprobarla primero para asegurarse de que es una remota. Como resultado, un usuario con altos privilegios podr\\u00eda usar esa funcionalidad para escanear la red interna por medio de un ataque SSRF\"}]",
      "id": "CVE-2021-24371",
      "lastModified": "2024-11-21T05:52:56.100",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 2.7, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:N/A:N\", \"baseScore\": 4.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-08-02T11:15:08.590",
      "references": "[{\"url\": \"https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/\", \"source\": \"contact@wpscan.com\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d\", \"source\": \"contact@wpscan.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "contact@wpscan.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"contact@wpscan.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-24371\",\"sourceIdentifier\":\"contact@wpscan.com\",\"published\":\"2021-08-02T11:15:08.590\",\"lastModified\":\"2024-11-21T05:52:56.100\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it\u0027s a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.\"},{\"lang\":\"es\",\"value\":\"La funcionalidad Import del plugin RSVPMaker de WordPress versiones anteriores a 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) toma una entrada de URL y llama a curl sobre ella, sin comprobarla primero para asegurarse de que es una remota. Como resultado, un usuario con altos privilegios podr\u00eda usar esa funcionalidad para escanear la red interna por medio de un ataque SSRF\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":2.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"contact@wpscan.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"8.7.3\",\"matchCriteriaId\":\"BFB474F8-B7BD-4735-A452-2FC6E4736282\"}]}]}],\"references\":[{\"url\":\"https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/\",\"source\":\"contact@wpscan.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d\",\"source\":\"contact@wpscan.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.