CVE-2021-24913CWE-352

Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

published February 28, 2022

CVSS
—
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00471 · 39.8th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-02-28T09:06Z
EPSS history
Timeline
  • 28 FEB 09:06Z
    Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF
    cvelistv5