what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure
CVE-2021-4428 has a selected CVSS score of 2.7 (low); EIP currently links 3 repository PoCs and 1 lab environment.
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
| Product | Source | Version range | Status |
|---|---|---|---|
Autosuggest PluginBrowse what3words / Autosuggest Plugin | CVE List | 4.0 | affected |
A Docker-based lab for demonstrating the Log4Shell vulnerability (CVE-2021-44228). It includes a vulnerable Spring Boot application, an HTTP server for hosting .class files, and an LDAP referral server. The packet contains the Dockerfile and source code for the vulnerable application, along with a README describing setup and exploitation.
README.md:1-73vulnapp/Dockerfile:1-11The README explicitly states it is a 'Log4Shell docker lab for CVE-2021-44228' and describes components, setup, and exploit steps. The application code logs user input with Log4j, which is the vulnerable behavior.
README.md:1vulnapp/src/main/java/com/axelcurmi/log4jvuln/controllers/BaseController.java:24A Spring Boot web application with a login form. It logs unsuccessful login attempts using Log4j, including the username, which is user-controlled. This makes it vulnerable to Log4Shell JNDI injection.
vulnapp/Dockerfile:1-11vulnapp/src/main/java/com/axelcurmi/log4jvuln/controllers/BaseController.java:24vulnapp/pom.xml:1-58An HTTP server that hosts .class files used for remote code execution. It is referenced in the README but its Dockerfile or source is not included in the packet.
README.md:4-5README.md:17An LDAP referral server that redirects LDAP queries to the HTTP server. It is referenced in the README but its Dockerfile or source is not included in the packet.
README.md:6README.md:18Insufficient evidence
The packet references 'CVE-2021-4428' in a comment in Log4jVulnerableApplication.java, but the README and the lab's purpose are for CVE-2021-44228. The provided evidence does not establish what CVE-2021-4428 refers to or whether it is a valid identifier. The comment may be a typo.
vulnapp/src/main/java/com/axelcurmi/log4jvuln/Log4jVulnerableApplication.java:9README.md:10-18README.md:10README.md:22-24README.md:15-18README.md:22-24README.md:27-28README.md:30-32The visible behavior is limited to building and running a deliberately vulnerable application inside Docker containers for educational purposes. The Dockerfile exposes port 8080 and sets an environment variable, which are expected for a web application lab. No hidden, destructive, or externally connecting behavior is present in the supplied evidence. The README describes exploitation steps that target the lab's own components.
vulnapp/Dockerfile:1-11README.md:1-73This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.