OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API
CVE-2021-24638

9.1CRITICAL

Key Information:

Vendor

Wordpress
Status
Omgf | Host Google Fonts Locally
Vendor
CVE Published:
20 September 2021

What is CVE-2021-24638?

The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.

Affected Version(s)

OMGF | Host Google Fonts Locally 4.5.4

References

https://wpscan.com/vulnerability/c783a746-f1fe-4d68-9d0a-...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

apple502j
.