CVE-2021-24696: falha em Simple Download Monitor
Simple Download Monitor < 3.9.9 - Multiple CSRF
Publicada em · Atualizada em
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.6%
probabilidade de exploração
0.6%top 51% das CVEs
exploração observada
nãonenhuma fonte reporta
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
Produtos afetados
Unknown · Simple Download MonitorCVEs relacionadas — Simple Download Monitor
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24695—Simple Download Monitor < 3.9.6 - Unauthenticated Log AccessEPSS 1.7%CVE-2021-24692—Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path TraversalEPSS 1.4%CVE-2021-24693—Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File ThumbnailEPSS 1.3%CVE-2021-24697—Simple Download Monitor < 3.9.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24698—Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails RemovalEPSS 0.7%CVE-2021-24694—Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via ShortcodesEPSS 0.6%