CVE-2021-24997

MEDIUMNuclei

WP Guppy < 1.3 - Sensitive Information Disclosure

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24997 has a selected CVSS score of 6.5 (medium); EIP currently links 1 Nuclei template.

Description

The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

WP Guppy

CVE List1.3 to < 1.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Guppy <=1.1 - Information DisclosureCVSS 6.5

WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the target system.

Remediation

Update to the latest version of the WordPress Guppy plugin (version >1.1) to mitigate the information disclosure vulnerability.

WeaknessesCWE-862
AuthorsEvan Rubinstein
Template tagscvecve2021wordpressguppyapiwp-pluginedbwpscanwp-guppyvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:wp-guppy:wp_guppy:*:*:*:*:*:wordpress:*:*
https://www.exploit-db.com/exploits/50540 https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900 https://nvd.nist.gov/vuln/detail/CVE-2021-24997 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3