CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-24171

The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.006

EPSS Ranking 68.8%

CVSS Severity

CVSS v3 Score 9.8

CVSS v2 Score 7.5

References

Products affected by CVE-2021-24171

Vanquish » Woocommerce Upload Files » Version: N/A

cpe:2.3:a:vanquish:woocommerce_upload_files:-
Vanquish » Woocommerce Upload Files » Version: 57.3

cpe:2.3:a:vanquish:woocommerce_upload_files:57.3
Vanquish » Woocommerce Upload Files » Version: 57.4

cpe:2.3:a:vanquish:woocommerce_upload_files:57.4
Vanquish » Woocommerce Upload Files » Version: 57.5

cpe:2.3:a:vanquish:woocommerce_upload_files:57.5
Vanquish » Woocommerce Upload Files » Version: 57.6

cpe:2.3:a:vanquish:woocommerce_upload_files:57.6
Vanquish » Woocommerce Upload Files » Version: 57.7

cpe:2.3:a:vanquish:woocommerce_upload_files:57.7
Vanquish » Woocommerce Upload Files » Version: 57.8

cpe:2.3:a:vanquish:woocommerce_upload_files:57.8
Vanquish » Woocommerce Upload Files » Version: 57.9

cpe:2.3:a:vanquish:woocommerce_upload_files:57.9
Vanquish » Woocommerce Upload Files » Version: 58.0

cpe:2.3:a:vanquish:woocommerce_upload_files:58.0
Vanquish » Woocommerce Upload Files » Version: 58.1

cpe:2.3:a:vanquish:woocommerce_upload_files:58.1
Vanquish » Woocommerce Upload Files » Version: 58.2

cpe:2.3:a:vanquish:woocommerce_upload_files:58.2
Vanquish » Woocommerce Upload Files » Version: 58.3

cpe:2.3:a:vanquish:woocommerce_upload_files:58.3
Vanquish » Woocommerce Upload Files » Version: 58.4

cpe:2.3:a:vanquish:woocommerce_upload_files:58.4
Vanquish » Woocommerce Upload Files » Version: 58.5

cpe:2.3:a:vanquish:woocommerce_upload_files:58.5
Vanquish » Woocommerce Upload Files » Version: 58.6

cpe:2.3:a:vanquish:woocommerce_upload_files:58.6
Vanquish » Woocommerce Upload Files » Version: 58.7

cpe:2.3:a:vanquish:woocommerce_upload_files:58.7
Vanquish » Woocommerce Upload Files » Version: 58.9

cpe:2.3:a:vanquish:woocommerce_upload_files:58.9
Vanquish » Woocommerce Upload Files » Version: 59.0

cpe:2.3:a:vanquish:woocommerce_upload_files:59.0
Vanquish » Woocommerce Upload Files » Version: 59.1

cpe:2.3:a:vanquish:woocommerce_upload_files:59.1
Vanquish » Woocommerce Upload Files » Version: 59.2

cpe:2.3:a:vanquish:woocommerce_upload_files:59.2
Vanquish » Woocommerce Upload Files » Version: 59.3

cpe:2.3:a:vanquish:woocommerce_upload_files:59.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-24171

Products

Pricing

Contact Us