CVE-2021-24696 Simple Download Monitor < 3.9.9 - Multiple CSRF

Q: What is CVE-2021-24696?

CVE-2021-24696 is a high-severity vulnerability in Unknown Simple Download Monitor, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2021-24696 being exploited?

There is no known exploitation of CVE-2021-24696 in the wild and no public exploit code.

Q: How do I fix CVE-2021-24696?

No fix has been published for CVE-2021-24696 yet. Limit exposure of the affected software until one is available.

High 8.8 Published 24 Jan 2022 Updated 3 Aug 2024

Attackers can trick admins into performing unauthorized actions like deleting logs or removing thumbnails via CSRF in the Simple Download Monitor plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-24696?

CVE-2021-24696 is a high-severity vulnerability in Unknown Simple Download Monitor, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads

Weakness: CWE-352

Which versions are affected by CVE-2021-24696?

It affects 1 product.

Products include Tipsandtricks-Hq Simple Download Monitor.

How do I fix CVE-2021-24696?

No fix has been published for CVE-2021-24696 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-24696 being exploited?

There is no known exploitation of CVE-2021-24696 in the wild and no public exploit code.

Sources

Also known as GHSA-58fg-5cpg-7jjv.