Aller au contenu
Se connecter
Non notée

CVE-2021-24638 The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows…

Description

The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.

Produits et versions touchés

Produit Versions touchées Corrigé en
OMGF | Host Google Fonts Locally 4.5 premières → < 4.5.4 4.5.4

Autres CVE de OMGF | Host Google Fonts Locally

Les 3 CVE de OMGF | Host Google Fonts Locally →
CVE-2021-25021 The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting,… Non notée CVE-2021-24639 The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the… Non notée
Suivre cette CVE