CVE-2021-24371
Low
Description
The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.
SeverityLow
CVSS2.7
Exploit probability—
ProductCarrcommunications Rsvpmaker
PublishedAug 2, 2021
First seenAug 2, 2021
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- carrcommunications rsvpmaker8.7.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| carrcommunications rsvpmaker | v < 8.7.3 | 8.7.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.