PT-2021-15996 · WordPress · Qt Kentharadio+1

Andreas Klöbl · Published 2021-08-02 · Updated 2021-08-27 · CVE-2021-24472

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OnAir2 WordPress theme versions prior to 3.9.9.2 QT KenthaRadio WordPress plugin versions prior to 2.0.2

Description The issue allows unauthenticated users to exploit exposed proxy functionality, enabling them to send requests that have the web server fetch and display content from any URI. This can lead to Server Side Request Forgery (SSRF) and Remote File Inclusion (RFI) vulnerabilities on the website.

Recommendations For OnAir2 WordPress theme versions prior to 3.9.9.2, update to version 3.9.9.2 or later. For QT KenthaRadio WordPress plugin versions prior to 2.0.2, update to version 2.0.2 or later. As a temporary workaround, consider disabling the exposed proxy functionality until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-24472

Affected Products

Onair2

Qt Kentharadio

References · 5

• 🔥 https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24472 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24472 · Vendor Advisory
• https://t.me/cibsecurity/26656 · Telegram Post
• https://t.me/cvenotify/19111 · Telegram Post