jetpack.com
https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin CVE-2021-24227
HIGHNuclei
Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
Record summary
CVE-2021-24227 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.
Description
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Dec 24, 2023 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Patreon WordPress | CVE List | 1.7.0 to < 1.7.0 | affected |
patreon_wordpressBrowse patreon / patreon_wordpress | VulnCheck | Version data not supplied | |
Nuclei templates
1ProjectDiscoveryHIGHPatreon WordPress <1.7.0 - Unauthenticated Local File InclusionCVSS 7.5
Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Impact
An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to further compromise of the system.
Remediation
Upgrade to Patreon WordPress plugin version 1.7.0 or later to mitigate this vulnerability.
WeaknessesCWE-200
Authorstheamanrawat
Template tagscvecve2021wordpresspatreon-connectunauthlfipatreonwpwpscanvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:patreon:patreon_wordpress:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016 https://wordpress.org/plugins/patreon-connect/ https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ https://nvd.nist.gov/vuln/detail/CVE-2021-24227 https://github.com/ARPSyndicate/cvemon
Source: ProjectDiscovery
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-24227 wpscan.comConfirmation
https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016