CVE-2021-24913CWE-352

CVE-2021-24913: vulnerability in Logo Showcase with Slick Slider – Logo…

Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

Published · Updated

Follow this CVE+ Monitor Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.5%
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.
Affected products
Unknown · Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid
Related CVEs — Logo Showcase with Slick Slider – Logo…

In the same product, most dangerous first.

CVE-2021-24729—Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site ScriptingEPSS 0.6%CVE-2021-24730—Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL UpdateEPSS 0.3%