PT-2021-15861 · WordPress · 404 Seo Redirection

M0Ze + 1 · Published 2021-05-17 · Updated 2021-05-24 · CVE-2021-24324

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions 404 SEO Redirection WordPress plugin versions 1.3 and earlier

Description The issue is related to the lack of CSRF checks in all settings of the plugin, allowing attackers to make a logged-in user change the plugin's settings. Additionally, due to the lack of sanitization and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues.

Recommendations For versions 1.3 and earlier, update to a version that includes CSRF checks and proper sanitization and escaping of fields to prevent Stored Cross-Site Scripting issues. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24324

Affected Products

404 Seo Redirection

References · 4

• 🔥 https://wpscan.com/vulnerability/63a24890-3735-4016-b4b7-4b070a842664 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24324 · Security Note
• https://t.me/cvenotify/14534 · Telegram Post