« Volver al listado

CVE-2021-24832

Estado: ModificadaMedia (4.3)—

El plugin WP SEO Redirect 301 de WordPress versiones anteriores a 2.3.2, no presenta CSRF cuando se eliminan las redirecciones, que podría permitir a atacantes hacer que un administrador conectado las elimine por medio de un ataque de tipo CSRF

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

WP SEO Redirect 301 Project — WP SEO Redirect 301

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24832",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "WP SEO Redirect 301",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.2",
              "lessThan": "2.3.2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-08T18:15:10.290",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/cf031259-b76e-475c-8a8e-fa6a0d9e7bb4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/cf031259-b76e-475c-8a8e-fa6a0d9e7bb4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack"
    },
    {
      "lang": "es",
      "value": "El plugin WP SEO Redirect 301 de WordPress versiones anteriores a 2.3.2, no presenta CSRF cuando se eliminan las redirecciones, que podría permitir a atacantes hacer que un administrador conectado las elimine por medio de un ataque de tipo CSRF"
    }
  ],
  "lastModified": "2026-06-17T03:40:59.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wp_seo_redirect_301_project:wp_seo_redirect_301:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "767F159A-C8AA-47D0-ACEC-89443339A617",
              "versionEndExcluding": "2.3.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}