CVE-2021-24638 OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API
Unauthenticated attackers can exploit a path traversal vulnerability in the OMGF WordPress plugin to overwrite arbitrary CSS files or download fonts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24638?
CVE-2021-24638 is a critical path traversal vulnerability in Unknown OMGF | Host Google Fonts Locally, published on 20 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Weakness: CWE-22
Which versions are affected by CVE-2021-24638?
It affects 1 product.
Products include Ffw Omgf.
How do I fix CVE-2021-24638?
No fix has been published for CVE-2021-24638 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-24638 being exploited?
There is no known exploitation of CVE-2021-24638 in the wild and no public exploit code.
Other vulnerabilities in Unknown OMGF | Host Google Fonts Locally
Sources
Also known as GHSA-728f-qcc4-8q48.