PT-2023-12541 · What3Words · What3Words Autosuggest Plugin

Published 2023-07-18 · Updated 2024-05-17 · CVE-2021-4428

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions what3words Autosuggest Plugin versions up to 4.0.0

Description A vulnerability has been found in the what3words Autosuggest Plugin, classified as problematic. The issue affects the enqueue scripts function of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler, leading to information disclosure. The attack can be launched remotely.

Recommendations For what3words Autosuggest Plugin versions up to 4.0.0, upgrade to version 4.0.1 to address this issue. As a temporary workaround, consider disabling the enqueue scripts function until the patch is applied. Restrict access to the vulnerable component Setting Handler to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-4428

Affected Products

What3Words Autosuggest Plugin

References · 9

• https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1 · Patch
• https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac · Patch
• https://github.com/what3words/wordpress-autosuggest-plugin/pull/20 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4428 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4428 · Vendor Advisory
• https://t.me/cibsecurity/66932 · Telegram Post
• https://vuldb.com/?id.234247 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4428 · Note
• https://vuldb.com/?ctiid.234247 · Note