CVE-2021-24584

 

Published at: - 20-09-2021 12:15

Last modified: - 29-08-2022 08:55

Total changes: - 5

Description

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://wpscan.com/vulnerability/60eadf75-8298-49de-877e-ce103fc34d58

 

Keywords

NVD

 

CVE-2021-24584

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures