CVE-2021-24227

Katalog CVE

CVSS 7.5 · High EPSS 5,9%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada patreon wordpress. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.

Rincian

Terbit di NVD

12 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

5,9% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ exploit · advisory pihak ketiga
• https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016 advisory pihak ketiga