CVE-2021-24853 QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update
Authenticated subscribers can modify arbitrary QR redirect response statuses due to missing capability and CSRF checks in the QR Redirector plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24853?
CVE-2021-24853 is a medium-severity missing authorization vulnerability in Unknown QR Redirector, published on 17 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
Which versions are affected by CVE-2021-24853?
It affects 1 product.
Products include Qr Redirector Project Qr Redirector.
How do I fix CVE-2021-24853?
No fix has been published for CVE-2021-24853 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24853 being exploited?
There is no known exploitation of CVE-2021-24853 in the wild and no public exploit code.
Other vulnerabilities in Unknown QR Redirector
Sources
Also known as GHSA-gg89-hw93-j4hc.