PT-2021-15708 · Unknown · Responsive Menu

Chloe Chamberland · Published 2021-04-05 · Updated 2021-04-08 · CVE-2021-24162

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Reponsive Menu versions prior to 4.0.4

Description: The issue allows attackers to craft a request and trick an administrator into importing new settings that could be modified to include malicious JavaScript. This enables an attacker to inject payloads, potentially leading to further infection of the site.

Recommendations: For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings import functionality to minimize the risk of exploitation. Avoid using the plugin's settings import feature until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24162

Affected Products

Responsive Menu

References · 5

• 🔥 https://wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin · Exploit
• 🔥 https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24162 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24162 · Vendor Advisory
• https://t.me/cvenotify/12950 · Telegram Post