PT-2022-9451 · WordPress · Simple Download Monitor

Apple502J · Published 2022-01-24 · Updated 2022-01-27 · CVE-2021-24696

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Download Monitor WordPress plugin versions prior to 3.9.9

Description The issue allows attackers to perform CSRF attacks, potentially leading to several outcomes, including making admins export logs to exploit a separate log disclosure vulnerability, deleting logs, and removing thumbnail images from downloads. The log disclosure vulnerability was fixed in version 3.9.6.

Recommendations For versions prior to 3.9.9, update to version 3.9.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the log export and deletion functions until a patch is available. Avoid using the plugin's log management features until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24696

Affected Products

Simple Download Monitor

References · 4

• 🔥 https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24696 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24696 · Vendor Advisory
• https://t.me/cibsecurity/36105 · Telegram Post