nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-24170 CVE-2021-24170
HIGHNuclei
User Profile Picture < 2.5.0 - Sensitive Information Disclosure
Record summary
CVE-2021-24170 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.
Description
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Dec 5, 2022 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
User Profile Picture | CVE List | 2.5.0 to < 2.5.0 | affected |
user_profile_pictureBrowse cozmoslabs / user_profile_picture | VulnCheck | Version data not supplied | |
Nuclei templates
1ProjectDiscoveryHIGHUser Profile Picture < 2.5.0 - Sensitive Information DisclosureCVSS 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Impact
Authenticated users with upload_files capability can extract sensitive user information including password hashes, activation keys, usernames, and email addresses via REST API endpoint.
Remediation
Update to User Profile Picture version 2.5.0 or later.
WeaknessesCWE-200
Authorss4e-io
Template tagscvecve2021wpwp-pluginwpscanwordpressinfo-leakauthenticatedmetronet-profile-picturevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:cozmoslabs:user_profile_picture:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/metronet-profile-picture"
https://www.wordfence.com/blog/2021/03/medium-severity-vulnerability-patched-in-user-profile-picture-plugin/ https://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc/ https://nvd.nist.gov/vuln/detail/CVE-2021-24170
Source: ProjectDiscovery
References
3wpscan.comConfirmation
https://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc wordfence.com
https://www.wordfence.com/blog/2021/03/medium-severity-vulnerability-patched-in-user-profile-picture-plugin