2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"3DPrint Lite","vendor":"Unknown","versions":[{"lessThan":"1.9.1.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"},{"affectedData":[{"cpes":["cpe:2.3:a:wp3dprinting:3dprint_lite:-:*:*:*:*:wordpress:*:*"],"defaultStatus":"unaffected","product":"3dprint_lite","vendor":"wp3dprinting","versions":[{"lessThan":"1.9.1.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wp3dprinting:3dprint_lite:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"65F6B829-EBB0-4DFA-8CAC-EE0BB929B1A7","versionEndExcluding":"1.9.1.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache."},{"lang":"es","value":"El complemento 3DPrint Lite de WordPress anterior a 1.9.1.5 no tiene ninguna autorización y no verifica el archivo cargado en su acción p3dlite_handle_upload AJAX, lo que permite a usuarios no autenticados cargar archivos arbitrarios al servidor web. Sin embargo, existe un .htaccess que impide acceder al archivo en servidores web como Apache."}],"id":"CVE-2021-4436","lastModified":"2026-06-17T04:19:45.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2021-4436","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-02-06T18:58:37.574670Z","version":"2.0.3"}}]},"published":"2024-02-05T09:15:43.013","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c46ecd0d-a132-4ad6-b936-8acde3a09282/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c46ecd0d-a132-4ad6-b936-8acde3a09282/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"nvd@nist.gov","type":"Primary"}]}
|