CVE-2021-24227: falha em Patreon WordPress
Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
40Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 6.8%
da publicação à arma
Publicada no NVD12 de abr.
VulnCheck+986d
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Produtos afetados
Unknown · Patreon WordPressCVEs relacionadas — Patreon WordPress
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24228—Patreon WordPress < 1.7.2 - Reflected XSS on Login FormEPSS 1.9%CVE-2021-24229—Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX actionEPSS 1.8%CVE-2021-25026—Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24230—Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User MetaEPSS 0.6%CVE-2021-24231—Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From PatreonEPSS 0.6%CVE-2026-92431LOWPatreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term EnumerationEPSS 0.2%