目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2021-24219— Wordpress plugin Controlled Admin Access 访问控制错误漏洞

一分钟漏洞结论

影响对象
Thrive Themes Thrive Optimize
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

WordPress 插件是WordPress开源的一个应用插件。 多款Wordpress插件存在安全漏洞，该漏洞允许攻击者使用此端点将任意数据添加到wp_options表中的预定义选项。以下产品及版本受到影响：The Thrive Optimize WordPress plugin 1.4.13.3版本之前，Thrive Comments WordPress plugin 1.4.15.3版本之前，Thrive Headline Optimizer WordPress plugin 1.3.7.3版本之前

AI 预测 6.5 利用难度: 较易 EPSS 2.06% · P81

公开利用映射 1

Nuclei · 1 CVE-2021-24219.yaml [template]
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2021-24219 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
All Thrive Themes and Plugins - Unauthenticated Option Update
来源: CVE Program / CVE List V5
Vulnerability Description
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
来源: CVE Program / CVE List V5
Vulnerability Title
Wordpress plugin Controlled Admin Access 访问控制错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
WordPress 插件是WordPress开源的一个应用插件。 多款Wordpress插件存在安全漏洞，该漏洞允许攻击者使用此端点将任意数据添加到wp_options表中的预定义选项。以下产品及版本受到影响：The Thrive Optimize WordPress plugin 1.4.13.3版本之前，Thrive Comments WordPress plugin 1.4.15.3版本之前，Thrive Headline Optimizer WordPress plugin 1.3.7.3版本之前
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
Thrive Themes Thrive Optimize 1.4.13.3 ~ 1.4.13.3 -
Thrive Themes Thrive Comments 1.4.15.3 ~ 1.4.15.3 -
Thrive Themes Thrive Headline Optimizer 1.3.7.3 ~ 1.3.7.3 -
Thrive Themes Thrive Leads 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Ultimatum 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Quiz Builder 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Apprentice 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Visual Editor 2.6.7.4 ~ 2.6.7.4 -
Thrive Themes Thrive Dashboard 2.3.9.3 ~ 2.3.9.3 -
Thrive Themes Thrive Ovation 2.4.5 ~ 2.4.5 -
Thrive Themes Thrive Clever Widgets 1.57.1 ~ 1.57.1 -
Thrive Themes Rise by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Ignition by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Luxe by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes FocusBlog by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Minus by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Squared by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Voice 2.0.0 ~ 2.0.0 -
Thrive Themes Performag by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Pressive by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Storied by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Thrive Themes Builder 2.2.4 ~ 2.2.4 -

二、漏洞 CVE-2021-24219 的公开POC

# POC 描述 源链接 神龙链接
1 The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24219.yaml POC详情
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2021-24219 的情报信息

请登录查看更多情报信息。

CVE-2021-24219 厂商安全公告 (2)

IV. Related Vulnerabilities

Same vendor: Thrive Themes
Same weakness: CWE-284

V. Comments for CVE-2021-24219

暂无评论

发表评论