CVE-2021-34629 SendGrid <= 1.11.8 – Authorization Bypass
Authenticated users can bypass authorization checks to export statistics from the main site in a WordPress multi-site environment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34629?
CVE-2021-34629 is a medium-severity missing authorization vulnerability in SendGrid, published on 30 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8.
Weakness: CWE-862
Which versions are affected by CVE-2021-34629?
It affects 1 product.
Products include Sendgrid Sendgrid.
How do I fix CVE-2021-34629?
No fix has been published for CVE-2021-34629 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-34629 being exploited?
There is no known exploitation of CVE-2021-34629 in the wild and no public exploit code.
Sources
Also known as GHSA-qrv5-mq63-4m4p.