CVE-2021-24272
Summary
| CVE | CVE-2021-24272 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-05-05 19:15:00 UTC |
| Updated | 2021-12-03 19:59:00 UTC |
| Description | The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue |
Risk And Classification
Problem Types: CWE-352
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Codeinitiator | Fitness Calculators | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| WordPress Fitness Calculators 1.9.5 Cross Site Request Forgery ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Attention Required! | Cloudflare | CONFIRM | wpscan.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: 0xB9
There are currently no legacy QID mappings associated with this CVE.