支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2021-24219 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
All Thrive Themes and Plugins - Unauthenticated Option Update
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
访问控制不恰当
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
Wordpress plugin Controlled Admin Access 访问控制错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
WordPress 插件是WordPress开源的一个应用插件。 多款Wordpress插件存在安全漏洞，该漏洞允许攻击者使用此端点将任意数据添加到wp_options表中的预定义选项。以下产品及版本受到影响：The Thrive Optimize WordPress plugin 1.4.13.3版本之前，Thrive Comments WordPress plugin 1.4.15.3版本之前，Thrive Headline Optimizer WordPress plugin 1.3.7.3版本之前
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
厂商产品影响版本CPE订阅
Thrive ThemesThrive Optimize 1.4.13.3 ~ 1.4.13.3 -
Thrive ThemesThrive Comments 1.4.15.3 ~ 1.4.15.3 -
Thrive ThemesThrive Headline Optimizer 1.3.7.3 ~ 1.3.7.3 -
Thrive ThemesThrive Leads 2.3.9.4 ~ 2.3.9.4 -
Thrive ThemesThrive Ultimatum 2.3.9.4 ~ 2.3.9.4 -
Thrive ThemesThrive Quiz Builder 2.3.9.4 ~ 2.3.9.4 -
Thrive ThemesThrive Apprentice 2.3.9.4 ~ 2.3.9.4 -
Thrive ThemesThrive Visual Editor 2.6.7.4 ~ 2.6.7.4 -
Thrive ThemesThrive Dashboard 2.3.9.3 ~ 2.3.9.3 -
Thrive ThemesThrive Ovation 2.4.5 ~ 2.4.5 -
Thrive ThemesThrive Clever Widgets 1.57.1 ~ 1.57.1 -
Thrive ThemesRise by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesIgnition by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesLuxe by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesFocusBlog by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesMinus by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesSquared by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesVoice 2.0.0 ~ 2.0.0 -
Thrive ThemesPerformag by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesPressive by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesStoried by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive ThemesThrive Themes Builder 2.2.4 ~ 2.2.4 -
二、漏洞 CVE-2021-24219 的公开POC
#POC 描述源链接神龙链接
1The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24219.yamlPOC详情
AI 生成 POC高级

未找到公开 POC。

登录以生成 AI POC
三、漏洞 CVE-2021-24219 的情报信息
Please 登录 to view more intelligence information
四、漏洞 CVE-2021-24219 的评论

暂无评论

发表评论