CVE-2021-24730CWE-352CWE-862

Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update

published February 28, 2022

CVSS
—
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2022-02-28T09:06Z
EPSS history
Timeline
  • 28 FEB 09:06Z
    Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update
    cvelistv5