CVE-2021-24359CWE-284

CVE-2021-24359: falha em The Plus Addons for Elementor Page Builder

The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar The Plus Addons for Elementor Page Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.1%
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
Produtos afetados
Unknown · The Plus Addons for Elementor Page Builder
CVEs relacionadas — The Plus Addons for Elementor Page Builder

No mesmo produto, das mais perigosas para as menos.

CVE-2021-24175—The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication BypassEPSS 17.2%CVE-2021-24351—The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)EPSS 2.5%CVE-2021-24358—The Plus Addons for Elementor Page Builder < 4.1.10 - Open RedirectEPSS 2.3%