Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update
Vulnerability Description
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-24584
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- dc11
More from Unknown
View All →Affected Vendor
Unknown
View all reports →