CVE-2021-24352 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export
Unauthenticated attackers can export site redirects due to missing capability and nonce checks in the Simple 301 Redirects plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24352?
CVE-2021-24352 is a high-severity missing authorization vulnerability in Unknown Simple 301 Redirects by BetterLinks, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
Weakness: CWE-862
Which versions are affected by CVE-2021-24352?
It affects 1 product.
Products include Wpdeveloper Simple 301 Redirects.
How do I fix CVE-2021-24352?
No fix has been published for CVE-2021-24352 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24352 being exploited?
There is no known exploitation of CVE-2021-24352 in the wild and no public exploit code.
Other vulnerabilities in Unknown Simple 301 Redirects by BetterLinks
- CVE-2021-24353 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import
- CVE-2021-24354 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation
- CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation
- CVE-2021-24355 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value
Sources
Also known as GHSA-4q9c-h5m8-8ffp.