Vulnerability CVE-2021-24197


Published: 2021-04-12

Description:
The wpDataTables ?? Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table.

Type:

CWE-284

(Improper Access Control)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.5/10
4.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Tms-outsource -> Wpdatatables 

 References:
https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/
https://wpdatatables.com/help/whats-new-changelog/
https://wpscan.com/vulnerability/a56c04a4-dda0-4a7f-a525-d0349a1fda2b

Copyright 2024, cxsecurity.com

 

Back to Top