CVE-2021-24688 Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion
Unauthenticated attackers can delete arbitrary posts due to missing authorization and CSRF checks in AJAX calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24688?
CVE-2021-24688 is a medium-severity missing authorization vulnerability in Unknown Orange Form, published on 28 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)
Which versions are affected by CVE-2021-24688?
It affects 1 product.
Products include Orange-Form Project Orange-Form.
How do I fix CVE-2021-24688?
No fix has been published for CVE-2021-24688 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24688 being exploited?
There is no known exploitation of CVE-2021-24688 in the wild and no public exploit code.
Other vulnerabilities in Unknown Orange Form
Sources
Also known as GHSA-3v4m-w579-rrr3.