daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enhancement: cves/2021/CVE-2021-24226.yaml by mp

patch-1
MostInterestingBotInTheWorld 2022-06-22 12:46:34 -04:00
parent 5e1368f0f5
commit a459e577c3
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
cves/2021/CVE-2021-24226.yaml
View File

@ -1,11 +1,10 @@
id: CVE-2021-24226
info:
name: AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage
name: AccessAlly <3.5.7 - Sensitive Information Leakage
author: dhiyaneshDK
severity: high
description: In the AccessAlly WordPress plugin before 3.5.7, the file \"resource/frontend/product/product-shortcode.php\" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which
contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
description: WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file \"resource/frontend/product/product-shortcode.php\" (which is responsible for the [accessally_order_form] shortcode) dumps serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, and no login or administrator role is required.
reference:
- https://wpscan.com/vulnerability/8e3e89fd-e380-4108-be23-00e87fbaad16
- https://nvd.nist.gov/vuln/detail/CVE-2021-24226
@ -32,3 +31,5 @@ requests:
- type: status
status:
- 200
# Enhanced by mp on 2022/06/22