PT-2021-14237 · Unknown · Software License Manager

Koken Tokuda · Published 2021-07-14 · Updated 2021-07-15 · CVE-2021-20782

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Software License Manager versions prior to 4.4.6

Description: A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators via unspecified vectors. This can lead to unauthorized access and actions within the system.

Recommendations: For versions prior to 4.4.6, update to version 4.4.6 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication checks or restrictions on sensitive actions to minimize the risk of exploitation. Restrict access to administrative functions to minimize the risk of CSRF attacks until the update is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-20782

Affected Products

Software License Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-20782 · Security Note
• https://tipsandtricks-hq.com/software-license-manager-plugin-for-wordpress · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20782 · Vendor Advisory
• https://wordpress.org/plugins/software-license-manager · Note
• https://t.me/cibsecurity/26134 · Telegram Post
• https://jvn.jp/en/jp/JVN89054582/index.html · Note
• https://t.me/cvenotify/17553 · Telegram Post