Threat Investigation
Request a demo

CVE-2021-24472

Critical

Description

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

SeverityCritical
CVSS9.8
Exploit probability—
ProductQantumthemes Kentharadio
PublishedAug 2, 2021
First seenAug 2, 2021
Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update
  • qantumthemes kentharadio2.0.2 or later
  • qantumthemes onair23.9.9.2 or later

Affected products

ProductAffected versionsFixed in
qantumthemes kentharadiov < 2.0.22.0.2
qantumthemes onair2v < 3.9.9.23.9.9.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.