diff --git a/cves/2021/CVE-2021-24838.yaml b/cves/2021/CVE-2021-24838.yaml index 60d575a346..67a35d7bf4 100644 --- a/cves/2021/CVE-2021-24838.yaml +++ b/cves/2021/CVE-2021-24838.yaml @@ -4,8 +4,9 @@ info: name: AnyComment < 0.3.5 - Open Redirect author: noobexploiter severity: medium - description: The plugin has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature. - reference: + description: | + The plugin has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature. + reference: | - https://wpscan.com/vulnerability/562e81ad-7422-4437-a5b4-fcab9379db82 - https://nvd.nist.gov/vuln/detail/CVE-2021-24838 classification: @@ -13,13 +14,17 @@ info: cvss-score: 6.1 cve-id: CVE-2021-24838 cwe-id: CWE-601 - tags: cve,cve2021,wordpress,wp-plugin,open-redirect + metadata: + verified: true + tags: cve,cve2021,wordpress,wp-plugin,redirect,anycomment requests: - method: GET path: - - "{{BaseURL}}/wp-json/anycomment/v1/auth/wordpress?redirect=https://interact.sh?a=https://example.com" + - "{{BaseURL}}/wp-json/anycomment/v1/auth/wordpress?redirect=https://interact.sh" + - "{{BaseURL}}/wp-json/anycomment/v1/auth/wordpress?redirect=https://interact.sh?a=https://interact.sh" + stop-at-first-match: true matchers-condition: and matchers: - type: regex