SQL Injection Vulnerability in WordPress Plugin by Vendor
CVE-2021-21925

7.7HIGH

Key Information:

Vendor

WordPress
Status
Advantech
Vendor
CVE Published:
22 December 2021

What is CVE-2021-21925?

This vulnerability allows an attacker to exploit a flaw in the handling of specially-crafted HTTP requests, specifically targeting the 'firm_filter' parameter. By sending authenticated requests, either directly or via cross-site request forgery, an attacker can manipulate SQL queries, potentially gaining unauthorized access to sensitive data. The vulnerability can affect any user authenticated with the system, underlining the importance of implementing proper security measures to safeguard against such exploits.

Affected Version(s)

Advantech Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021)

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.