CVE-2021-24227

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

5.93%

Published

Apr 12, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200CWE-200

Affected Products (1)

patreon · patreon_wordpress (up to 1.7.0)vulnerable

References (4)

https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/

ExploitThird Party Advisory

https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016

Third Party Advisory

https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/

ExploitThird Party Advisory

https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs