404 to 301 < 3.0.9 - Logs Deletion via CSRF
CVE-2021-24766

6.5MEDIUM

Key Information:

Vendor

Wordpress
Status
404 To 301 – Redirect, Log And Notify 404 Errors
Vendor
CVE Published:
8 November 2021

What is CVE-2021-24766?

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack

Affected Version(s)

404 to 301 – Redirect, Log and Notify 404 Errors 3.0.9

References

https://wpscan.com/vulnerability/cc13db1e-5f7f-49b2-81da-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

apple502j
.