GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-38314 (GCVE-0-2021-38314)

Vulnerability from cvelistv5 – Published: 2021-09-02 16:53 – Updated: 2025-05-05 14:49
VLAI
Title
Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
Summary
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-05 14:49 UTC
CWE
  • CWE-200 - Information Exposure
  • CWE-760 - Use of a One-Way Hash with a Predictable Salt
Assigner
References
Impacted products
Vendor Product Version CPE status
Redux.io Gutenberg Template Library & Redux Framework Affected: 4.2.11 , ≤ 4.2.11 (custom)
guessed Create a notification for this product.
Date Public
2021-09-01 00:00
Credits
Ramuel Gall, Wordfence
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:37:16.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38314",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-05T14:49:45.607205Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T14:49:49.173Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Gutenberg Template Library \u0026 Redux Framework",
          "vendor": "Redux.io",
          "versions": [
            {
              "lessThanOrEqual": "4.2.11",
              "status": "affected",
              "version": "4.2.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ramuel Gall, Wordfence"
        }
      ],
      "datePublic": "2021-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of \u0027-redux\u0027 and an md5 hash of the previous hash with a known salt value of \u0027-support\u0027. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site\u0027s PHP version, and an unsalted md5 hash of site\u2019s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-760",
              "description": "CWE-760 Use of a One-Way Hash with a Predictable Salt",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-02T16:53:54.000Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Sensitive Information Disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@wordfence.com",
          "DATE_PUBLIC": "2021-09-01T00:00:00.000Z",
          "ID": "CVE-2021-38314",
          "STATE": "PUBLIC",
          "TITLE": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Sensitive Information Disclosure"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Gutenberg Template Library \u0026 Redux Framework",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "4.2.11",
                            "version_value": "4.2.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Redux.io"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Ramuel Gall, Wordfence"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of \u0027-redux\u0027 and an md5 hash of the previous hash with a known salt value of \u0027-support\u0027. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site\u0027s PHP version, and an unsalted md5 hash of site\u2019s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200 Information Exposure"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-760 Use of a One-Way Hash with a Predictable Salt"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/",
              "refsource": "MISC",
              "url": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/"
            }
          ]
        },
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2021-38314",
    "datePublished": "2021-09-02T16:53:54.200Z",
    "dateReserved": "2021-08-09T00:00:00.000Z",
    "dateUpdated": "2025-05-05T14:49:49.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-38314",
      "date": "2026-09-16",
      "epss": "0.28961",
      "percentile": "0.9806"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redux:gutenberg_template_library_\\\\\u0026_redux_framework:*:*:*:*:*:wordpress:*:*\", \"versionEndIncluding\": \"4.2.11\", \"matchCriteriaId\": \"8A4CBC31-7B53-462B-B51E-385476AF1E0E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of \u0027-redux\u0027 and an md5 hash of the previous hash with a known salt value of \u0027-support\u0027. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site\u0027s PHP version, and an unsalted md5 hash of site\\u2019s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.\"}, {\"lang\": \"es\", \"value\": \"El plugin Gutenberg Template Library \u0026amp; Redux Framework versiones anteriores a 4.2.11 incluy\\u00e9ndola para WordPress, registraba varias acciones AJAX disponibles para usuarios no autenticados en la funci\\u00f3n \\\"includes\\\" en el archivo \\\"redux-core/class-redux-core.php\\\" que eran \\u00fanicas para un sitio determinado pero deterministas y predecibles dado que se basaban en un hash md5 de la URL del sitio con un valor de salt conocido de \\\"-redux\\\" y un hash md5 del hash anterior con un valor de salt conocido de \\\"-support\\\". Estas acciones AJAX podr\\u00edan ser usadas para recuperar una lista de plugins activos y sus versiones, la versi\\u00f3n PHP del sitio, y un hash md5 sin salt de la \\\"AUTH_KEY\\\" del sitio concatenada con la \\\"SECURE_AUTH_KEY\\\"\"}]",
      "id": "CVE-2021-38314",
      "lastModified": "2024-11-21T06:16:46.620",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@wordfence.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-09-02T17:15:09.777",
      "references": "[{\"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\", \"source\": \"security@wordfence.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security@wordfence.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@wordfence.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}, {\"lang\": \"en\", \"value\": \"CWE-760\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-916\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-38314\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2021-09-02T17:15:09.777\",\"lastModified\":\"2024-11-21T06:16:46.620\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of \u0027-redux\u0027 and an md5 hash of the previous hash with a known salt value of \u0027-support\u0027. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site\u0027s PHP version, and an unsalted md5 hash of site\u2019s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.\"},{\"lang\":\"es\",\"value\":\"El plugin Gutenberg Template Library \u0026amp; Redux Framework versiones anteriores a 4.2.11 incluy\u00e9ndola para WordPress, registraba varias acciones AJAX disponibles para usuarios no autenticados en la funci\u00f3n \\\"includes\\\" en el archivo \\\"redux-core/class-redux-core.php\\\" que eran \u00fanicas para un sitio determinado pero deterministas y predecibles dado que se basaban en un hash md5 de la URL del sitio con un valor de salt conocido de \\\"-redux\\\" y un hash md5 del hash anterior con un valor de salt conocido de \\\"-support\\\". Estas acciones AJAX podr\u00edan ser usadas para recuperar una lista de plugins activos y sus versiones, la versi\u00f3n PHP del sitio, y un hash md5 sin salt de la \\\"AUTH_KEY\\\" del sitio concatenada con la \\\"SECURE_AUTH_KEY\\\"\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-760\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-916\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redux:gutenberg_template_library_\\\\\u0026_redux_framework:*:*:*:*:*:wordpress:*:*\",\"versionEndIncluding\":\"4.2.11\",\"matchCriteriaId\":\"8A4CBC31-7B53-462B-B51E-385476AF1E0E\"}]}]}],\"references\":[{\"url\":\"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\",\"source\":\"security@wordfence.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T04:51:50+00:00",
      "cve": "CVE-2021-38314",
      "id": "CVE-2021-38314",
      "initial_release_date": "2021-09-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Sensitive Information Disclosure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-38314.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"product\": \"Gutenberg Template Library \u0026 Redux Framework\", \"vendor\": \"Redux.io\", \"versions\": [{\"lessThanOrEqual\": \"4.2.11\", \"status\": \"affected\", \"version\": \"4.2.11\", \"versionType\": \"custom\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Ramuel Gall, Wordfence\"}], \"datePublic\": \"2021-09-01T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of \u0027-redux\u0027 and an md5 hash of the previous hash with a known salt value of \u0027-support\u0027. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site\u0027s PHP version, and an unsalted md5 hash of site\\u2019s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-200\", \"description\": \"CWE-200 Information Exposure\", \"lang\": \"en\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-760\", \"description\": \"CWE-760 Use of a One-Way Hash with a Predictable Salt\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-09-02T16:53:54.000Z\", \"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\"}], \"source\": {\"discovery\": \"INTERNAL\"}, \"title\": \"Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Sensitive Information Disclosure\", \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security@wordfence.com\", \"DATE_PUBLIC\": \"2021-09-01T00:00:00.000Z\", \"ID\": \"CVE-2021-38314\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Sensitive Information Disclosure\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Gutenberg Template Library \u0026 Redux Framework\", \"version\": {\"version_data\": [{\"version_affected\": \"\u003c=\", \"version_name\": \"4.2.11\", \"version_value\": \"4.2.11\"}]}}]}, \"vendor_name\": \"Redux.io\"}]}}, \"credit\": [{\"lang\": \"eng\", \"value\": \"Ramuel Gall, Wordfence\"}], \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of \u0027-redux\u0027 and an md5 hash of the previous hash with a known salt value of \u0027-support\u0027. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site\u0027s PHP version, and an unsalted md5 hash of site\\u2019s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.\"}]}, \"generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"impact\": {\"cvss\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-200 Information Exposure\"}]}, {\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-760 Use of a One-Way Hash with a Predictable Salt\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\", \"refsource\": \"MISC\", \"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\"}]}, \"source\": {\"discovery\": \"INTERNAL\"}}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T01:37:16.480Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-38314\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-05T14:49:45.607205Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-05T14:49:40.606Z\"}}]}",
      "cveMetadata": "{\"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"assignerShortName\": \"Wordfence\", \"cveId\": \"CVE-2021-38314\", \"datePublished\": \"2021-09-02T16:53:54.200Z\", \"dateReserved\": \"2021-08-09T00:00:00.000Z\", \"dateUpdated\": \"2025-05-05T14:49:49.173Z\", \"state\": \"PUBLISHED\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.