CVE-2021-24133CWE-352

ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings

published March 18, 2021

CVSS
—
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-03-18T14:57Z
EPSS history
Timeline
  • 18 MAR 14:57Z
    ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings
    cvelistv5