CVE-2021-24374 Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak
Attackers can view comments on unpublished pages and posts via the Jetpack Carousel module, exposing private content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-24374?
CVE-2021-24374 is a medium-severity vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth, published on 21 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
Weakness: CWE-639
Which versions are affected by CVE-2021-24374?
2 open source packages ship an affected version, including automattic/jetpack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
automattic/jetpack Packagist | All versions | 9.8 |
automattic/jetpack Packagist | All versions | 9.8 |
Products include Automattic Jetpack.
How do I fix CVE-2021-24374?
Upgrade automattic/jetpack to 9.8 or later.
Is CVE-2021-24374 being exploited?
There is no known exploitation of CVE-2021-24374 in the wild and no public exploit code.
Other vulnerabilities in Automattic Jetpack – WP Security, Backup, Speed, & Growth
- CVE-2023-2996 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
- CVE-2011-4673 SQL injection in n/a
- CVE-2023-45050 WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-4392 Cross-site scripting in Jetpack – WP Security, Backup, Speed, & Growth
- CVE-2024-10858 Jetpack 13.0-14.0 - Unauthenticated DOM-XSS
Sources
Also known as GHSA-5hr6-r8h6-wh22.