CVE-2021-24148
MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Un problema de lógica empresarial en el plugin de WordPress MStore API, versiones anteriores a 3.2.0, presentaba una omisión de autenticación con Sign In With Apple que permitía a usuarios no autenticados recuperar una cookie de autenticación con solo una dirección de correo electrónico
*Credits:
Vincent Datrier
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-01-14 CVE Reserved
- 2021-02-02 CVE Published
- 2023-12-16 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-287: Improper Authentication
- CWE-288: Authentication Bypass Using an Alternate Path or Channel
CAPEC
References (1)
URL | Tag | Source |
---|---|---|
https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Inspireui Search vendor "Inspireui" | Mstore Api Search vendor "Inspireui" for product "Mstore Api" | < 3.2.0 Search vendor "Inspireui" for product "Mstore Api" and version " < 3.2.0" | wordpress |
Affected
|