CVE-2021-24977 Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending
Unauthenticated attackers can inject arbitrary CSS and potentially XSS payloads into the site for all users due to missing authorization checks in the font assignment feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24977?
CVE-2021-24977 is a medium-severity missing authorization vulnerability in Unknown Use Any Font | Custom Font Uploader, published on 28 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues
Weakness: CWE-862
Which versions are affected by CVE-2021-24977?
It affects 1 product.
Products include Dineshkarki Use Any Font.
How do I fix CVE-2021-24977?
No fix has been published for CVE-2021-24977 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24977 being exploited?
There is no known exploitation of CVE-2021-24977 in the wild and no public exploit code.
Other vulnerabilities in Unknown Use Any Font | Custom Font Uploader
Sources
Also known as GHSA-vj7q-773h-8qqf.