CVE-2021-4096 - Vulnerability Details - OpenCVE

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Radykal	Fancy Product Designer

Configuration 1 [-]

cpe:2.3:a:radykal:fancy_product_designer:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://support.fancyproductdesigner.com/support/discussions/topics/13000031615
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096

History

No history.

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2022-04-19T20:26:38

Updated: 2024-08-03T17:16:04.128Z

Reserved: 2021-12-10T00:00:00

Link: CVE-2021-4096

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-19T21:15:13.550

Modified: 2024-11-21T06:36:53.577

Link: CVE-2021-4096

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Fancy Product Designer", "vendor": "\tfancy-product-designer", "versions": [{"lessThanOrEqual": "4.7.5", "status": "affected", "version": "4.7.5", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Lin Yu"}], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-19T20:26:38", "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096"}, {"tags": ["x_refsource_MISC"], "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000031615"}], "solutions": [{"lang": "en", "value": "Update to version 4.7.6, or newer. "}], "source": {"discovery": "UNKNOWN"}, "title": "Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "Wordfence", "ASSIGNER": "security@wordfence.com", "ID": "CVE-2021-4096", "STATE": "PUBLIC", "TITLE": "Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Fancy Product Designer", "version": {"version_data": [{"version_affected": "<=", "version_name": "4.7.5", "version_value": "4.7.5"}]}}]}, "vendor_name": "\tfancy-product-designer"}]}}, "credit": [{"lang": "eng", "value": "Lin Yu"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}, {"description": [{"lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]}, "references": {"reference_data": [{"name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096", "refsource": "MISC", "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096"}, {"name": "https://support.fancyproductdesigner.com/support/discussions/topics/13000031615", "refsource": "MISC", "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000031615"}]}, "solution": [{"lang": "en", "value": "Update to version 4.7.6, or newer. "}], "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:16:04.128Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000031615"}]}]}, "cveMetadata": {"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2021-4096", "datePublished": "2022-04-19T20:26:38", "dateReserved": "2021-12-10T00:00:00", "dateUpdated": "2024-08-03T17:16:04.128Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:radykal:fancy_product_designer:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "0C981D6F-6F80-4A25-896B-CE3A658C61EC", "versionEndIncluding": "4.7.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5."}, {"lang": "es", "value": "El plugin Fancy Product Designer para WordPress es vulnerable a un ataque de tipo Cross-Site Request Forgery por medio de la clase FPD_Admin_Import que hace posible que atacantes suban archivos maliciosos que podr\u00edan ser usados para conseguir acceso webshell a un servidor en versiones hasta, e incluyendo, la 4.7.5"}], "id": "CVE-2021-4096", "lastModified": "2024-11-21T06:36:53.577", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-19T21:15:13.550", "references": [{"source": "security@wordfence.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000031615"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000031615"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}