CVE-2021-24730 Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update
Authenticated users can modify arbitrary media metadata due to missing authorization checks in the Logo Showcase with Slick Slider plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24730?
CVE-2021-24730 is a medium-severity missing authorization vulnerability in Unknown Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid, published on 28 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
Which versions are affected by CVE-2021-24730?
It affects 1 product.
Products include Infornweb Logo Showcase With Slick Slider.
How do I fix CVE-2021-24730?
No fix has been published for CVE-2021-24730 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24730 being exploited?
There is no known exploitation of CVE-2021-24730 in the wild and no public exploit code.
Other vulnerabilities in Unknown Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid
Sources
Also known as GHSA-fm23-hrfg-rmqx.