CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2021-24227 – Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
https://notcve.org/view.php?id=CVE-2021-24227
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies. El equipo de Jetpack Scan identificó una vulnerabilidad de Divulgación de Archivos Locales en el plugin Patreon WordPress versiones anteriores a 1.7.0, que podría ser abusado por cualquiera que visite el sitio. Con este vector de ataque, un atacante podría filtrar archivos internos importantes como wp-config.php, que contiene credenciales de base de datos y claves criptográficas utilizadas en la generación de nonces y cookies • https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24231 – Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon
https://notcve.org/view.php?id=CVE-2021-24231
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link. El equipo de Jetpack Scan identificó una vulnerabilidad de tipo Cross-Site Request Forgery en el plugin Patreon de WordPress versiones anteriores a 1.7.0, permitiendo a un atacante hacer que un administrador registrado desconecte el sitio de Patreon al visitar un enlace especialmente diseñado • https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin https://wpscan.com/vulnerability/f8ab6855-a319-47ac-82fb-58b181e77500 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20984 – Patreon WordPress < 1.2.2 - PHP Object Injection
https://notcve.org/view.php?id=CVE-2018-20984
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection. El complemento patreon-connect en versiones anteriores a 1.2.2 para WordPress tiene inyección de objetos. The Patreon WordPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2.2 via deserialization of untrusted input via the 'state' parameter. This makes it possible for attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. • https://wordpress.org/plugins/patreon-connect/#developers • CWE-502: Deserialization of Untrusted Data •