CVE-2021-24711 Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRF

Q: What is CVE-2021-24711?

CVE-2021-24711 is a high-severity vulnerability in Unknown Software License Manager, published on 11 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2021-24711 being exploited?

There is no known exploitation of CVE-2021-24711 in the wild and no public exploit code.

Q: How do I fix CVE-2021-24711?

No fix has been published for CVE-2021-24711 yet. Limit exposure of the affected software until one is available.

High 8.8 Published 11 Oct 2021 Updated 3 Aug 2024

Attackers can trick authenticated users into deleting arbitrary domains via CSRF in the Software License Manager WordPress plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-24711?

CVE-2021-24711 is a high-severity vulnerability in Unknown Software License Manager, published on 11 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack

Weakness: CWE-352

Which versions are affected by CVE-2021-24711?

It affects 1 product.

Products include Tipsandtricks-Hq Software License Manager.

How do I fix CVE-2021-24711?

No fix has been published for CVE-2021-24711 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-24711 being exploited?

There is no known exploitation of CVE-2021-24711 in the wild and no public exploit code.

Sources

Also known as GHSA-vp58-4w6c-9hj5.