CVE Vulnerabilities

CVE-2021-24192

Published: May 14, 2021 | Modified: Jul 30, 2022
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Low privileged users can use the AJAX action cp_plugins_do_button_job_later_callback in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.

Affected Software

Name Vendor Start Version End Version
Sitemap Sitemap_project * 2.9 (excluding)

References