CVE-2021-24353 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import
Unauthenticated attackers can import site redirects due to missing capability and nonce checks in the import function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24353?
CVE-2021-24353 is a high-severity missing authorization vulnerability in Unknown Simple 301 Redirects by BetterLinks, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Weakness: CWE-862
Which versions are affected by CVE-2021-24353?
It affects 1 product.
Products include Wpdeveloper Simple 301 Redirects.
How do I fix CVE-2021-24353?
No fix has been published for CVE-2021-24353 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24353 being exploited?
There is no known exploitation of CVE-2021-24353 in the wild and no public exploit code.
Other vulnerabilities in Unknown Simple 301 Redirects by BetterLinks
- CVE-2021-24352 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export
- CVE-2021-24354 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation
- CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation
- CVE-2021-24355 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value
Sources
Also known as GHSA-jpx5-rg85-r3xv.