CVE-2021-24359CWE-284

CVE-2021-24359: fallo en The Plus Addons for Elementor Page Builder

The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear The Plus Addons for Elementor Page Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.1%
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
Productos afectados
Unknown · The Plus Addons for Elementor Page Builder
CVEs relacionadas — The Plus Addons for Elementor Page Builder

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24175—The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication BypassEPSS 17.2%CVE-2021-24351—The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)EPSS 2.5%CVE-2021-24358—The Plus Addons for Elementor Page Builder < 4.1.10 - Open RedirectEPSS 2.3%