PT-2021-15996
CVE-2021-24472
·
تاريخ النشر
2021-08-02
·
تاريخ التحديث
2021-08-27
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
OnAir2 WordPress theme versions prior to 3.9.9.2
QT KenthaRadio WordPress plugin versions prior to 2.0.2
Description
The issue allows unauthenticated users to exploit exposed proxy functionality, enabling them to send requests that have the web server fetch and display content from any URI. This can lead to Server Side Request Forgery (SSRF) and Remote File Inclusion (RFI) vulnerabilities on the website.
Recommendations
For OnAir2 WordPress theme versions prior to 3.9.9.2, update to version 3.9.9.2 or later.
For QT KenthaRadio WordPress plugin versions prior to 2.0.2, update to version 2.0.2 or later.
As a temporary workaround, consider disabling the exposed proxy functionality until a patch is available.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾