github - ghsa-jvmr-8pwj-ffqf

GHSA-JVMR-8PWJ-FFQF

Vulnerability from github – Published: 2022-01-11 00:00 – Updated: 2022-11-04 19:01

Details

The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-25032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-10T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin\u0027s settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.",
  "id": "GHSA-jvmr-8pwj-ffqf",
  "modified": "2022-11-04T19:01:10Z",
  "published": "2022-01-11T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25032"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2640161"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/2f0f1a32-0c7a-48e6-8617-e0b2dcf62727"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2021-25032 (GCVE-0-2021-25032)

Vulnerability from cvelistv5 – Published: 2022-01-10 00:00 – Updated: 2024-08-03 19:49

Title

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

Summary

Severity ?

No CVSS data available.

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)
CWE-862 - Missing Authorization

Assigner

WPScan

References

URL

Tags

	https://wpscan.com/vulnerability/2f0f1a32-0c7a-48…
	https://plugins.trac.wordpress.org/changeset/2640161

Impacted products

Vendor

Product

Version

Unknown

PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus

Affected: 2.0 , < 2.0* (custom)
Affected: 2.3.1 , < 2.3.1 (custom)

Unknown

PublishPress Capabilities Pro

Affected: 2.0 , < 2.0* (custom)
Affected: 2.3.1 , < 2.3.1 (custom)

Credits

Krzysztof Zając

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:49:14.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/2f0f1a32-0c7a-48e6-8617-e0b2dcf62727"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2640161"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PublishPress Capabilities \u2013 User Role Access, Editor Permissions, Admin Menus",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.0*",
              "status": "affected",
              "version": "2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.3.1",
              "status": "affected",
              "version": "2.3.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "PublishPress Capabilities Pro",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.0*",
              "status": "affected",
              "version": "2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.3.1",
              "status": "affected",
              "version": "2.3.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Krzysztof Zaj\u0105c"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin\u0027s settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-07T00:00:00",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "url": "https://wpscan.com/vulnerability/2f0f1a32-0c7a-48e6-8617-e0b2dcf62727"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/2640161"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "PublishPress Capabilities \u003c 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise",
      "x_generator": "WPScan CVE Generator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-25032",
    "datePublished": "2022-01-10T00:00:00",
    "dateReserved": "2021-01-14T00:00:00",
    "dateUpdated": "2024-08-03T19:49:14.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-JVMR-8PWJ-FFQF

CVE-2021-25032 (GCVE-0-2021-25032)

Tags

Sightings

Nomenclature