Pular para o conteúdo
Ver todas as ameaças

CVE-2021-24584

Alvo: Não informado

Descrição

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

Software
Não informado
Tipo Software
Plugin
CVE
CVE-2021-24584
Tags
Nâo informado
Data de publicação
20/09/2021
Última atualização
21/12/2022
Pontuação em CVSS 3.0
5.4
Médio
plugins premium WordPress