CVE-2021-39321 - OpenCVE

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Heateor	Sassy Social Share

Configuration 1 [-]

cpe:2.3:a:heateor:sassy_social_share:3.3.23:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php
https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321

History

No history.

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2021-10-21T19:38:52.886960Z

Updated: 2024-09-16T16:38:46.684Z

Reserved: 2021-08-20T00:00:00

Link: CVE-2021-39321

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-10-21T20:15:07.857

Modified: 2021-10-25T19:58:19.327

Link: CVE-2021-39321

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Sassy Social Share", "vendor": "Sassy Social Share", "versions": [{"status": "affected", "version": "3.3.23"}]}], "credits": [{"lang": "en", "value": "Chloe Chamberland, Wordfence"}], "datePublic": "2021-10-21T00:00:00", "descriptions": [{"lang": "en", "value": "Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-21T19:38:52", "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"}, {"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/"}, {"tags": ["x_refsource_MISC"], "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"}], "solutions": [{"lang": "en", "value": "Update to version 3.3.24"}], "source": {"discovery": "EXTERNAL"}, "title": "Sassy Social Share 3.3.23 PHP Object Injection", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "Wordfence", "ASSIGNER": "security@wordfence.com", "DATE_PUBLIC": "2021-10-21T16:05:00.000Z", "ID": "CVE-2021-39321", "STATE": "PUBLIC", "TITLE": "Sassy Social Share 3.3.23 PHP Object Injection"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Sassy Social Share", "version": {"version_data": [{"version_affected": "=", "version_name": "3.3.23", "version_value": "3.3.23"}]}}]}, "vendor_name": "Sassy Social Share"}]}}, "credit": [{"lang": "eng", "value": "Chloe Chamberland, Wordfence"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-863 Incorrect Authorization"}]}, {"description": [{"lang": "eng", "value": "CWE-502 Deserialization of Untrusted Data"}]}]}, "references": {"reference_data": [{"name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321", "refsource": "MISC", "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"}, {"name": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/", "refsource": "MISC", "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/"}, {"name": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php", "refsource": "MISC", "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"}]}, "solution": [{"lang": "en", "value": "Update to version 3.3.24"}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:06:41.490Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"}]}]}, "cveMetadata": {"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2021-39321", "datePublished": "2021-10-21T19:38:52.886960Z", "dateReserved": "2021-08-20T00:00:00", "dateUpdated": "2024-09-16T16:38:46.684Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:heateor:sassy_social_share:3.3.23:*:*:*:*:wordpress:*:*", "matchCriteriaId": "85E2FF17-725D-4A71-8694-AC75A682A27A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function."}, {"lang": "es", "value": "La versi\u00f3n 3.3.23 del plugin Sassy Social Share de WordPress es vulnerable a una inyecci\u00f3n de objetos de PHP por medio de la acci\u00f3n AJAX wp_ajax_heateor_sss_import_config debido a una deserializaci\u00f3n de entradas no validadas por el usuario por medio de la funci\u00f3n import_config que se encuentra en el archivo ~/admin/class-sassy-social-share-admin.php. Esto puede ser explotado por usuarios autenticados no privilegiados debido a una falta de comprobaci\u00f3n de capacidades en la funci\u00f3n import_config"}], "id": "CVE-2021-39321", "lastModified": "2021-10-25T19:58:19.327", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2021-10-21T20:15:07.857", "references": [{"source": "security@wordfence.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"}, {"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-863"}], "source": "security@wordfence.com", "type": "Primary"}]}