PT-2022-9507 · WordPress · The Logo Showcase With Slick Slider

Apple502J · Published 2022-02-28 · Updated 2022-03-07 · CVE-2021-24913

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions The Logo Showcase with Slick Slider WordPress plugin versions prior to 2.0.1

Description The issue concerns a lack of CSRF check in the "lswss save attachment data" AJAX action. This allows attackers to manipulate a logged-in high privilege user into changing the title, description, alt text, and URL of arbitrary uploaded media.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "lswss save attachment data" AJAX action to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24913

Affected Products

The Logo Showcase With Slick Slider

References · 5

• 🔥 https://wpscan.com/vulnerability/2f499945-1924-49f0-ad6e-9192273a5c05 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24913 · Security Note
• https://plugins.trac.wordpress.org/changeset/2669404 · Note
• https://t.me/cvenotify/27835 · Telegram Post