« Volver al listado

CVE-2021-36861

Estado: ModificadaMedia (4.3)—

Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Starfish — Rich Review

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-36861",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-36861",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-20T19:27:33.622361Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "audit@patchstack.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "audit@patchstack.com",
      "affectedData": [
        {
          "vendor": "Starfish Reviews",
          "product": "Rich Reviews by Starfish (WordPress plugin)",
          "versions": [
            {
              "status": "affected",
              "version": "<= 1.9.14",
              "versionType": "custom",
              "lessThanOrEqual": "1.9.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-05T16:15:10.867",
  "references": [
    {
      "url": "https://patchstack.com/database/vulnerability/rich-reviews/wordpress-rich-reviews-by-starfish-plugin-1-9-14-cross-site-request-forgery-csrf-vulnerability",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://wordpress.org/plugins/rich-reviews/#developers",
      "tags": [
        "Product"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/rich-reviews/wordpress-rich-reviews-by-starfish-plugin-1-9-14-cross-site-request-forgery-csrf-vulnerability",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/rich-reviews/#developers",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "audit@patchstack.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin Rich Reviews by Starfish versiones anteriores a 1.9.14 incluyéndola, en WordPress, que permite a un atacante eliminar reseñas"
    }
  ],
  "lastModified": "2026-06-17T03:59:32.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:starfish:rich_review:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06F8EA61-EE61-4B97-9B09-36C7FEE4617A",
              "versionEndIncluding": "1.9.14"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "audit@patchstack.com"
}