CVE-2021-4364: falha de média gravidade em eyecix JobSearch WP Job Board
JobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.7%
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
eyecix · JobSearch WP Job BoardCVEs relacionadas — eyecix JobSearch WP Job Board
No mesmo produto, das mais perigosas para as menos.
CVE-2021-4361HIGHJobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options UpdateEPSS 1.2%CVE-2024-8615CRITICALWP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2021-4352MEDIUMJobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings ChangeEPSS 0.8%CVE-2024-8614CRITICALWP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.8%CVE-2024-11925CRITICALWP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege EscalationEPSS 0.7%CVE-2024-11917HIGHJobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social LoginsEPSS 0.5%