github - ghsa-pxqp-jhw5-pvjr

ghsa-pxqp-jhw5-pvjr

Vulnerability from github

Published

2022-05-24 19:18

Modified

2022-05-24 19:18

Details

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-39321"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-21T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.",
  "id": "GHSA-pxqp-jhw5-pvjr",
  "modified": "2022-05-24T19:18:25Z",
  "published": "2022-05-24T19:18:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39321"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2021-39321 (GCVE-0-2021-39321)

Vulnerability from cvelistv5

Published

2021-10-21 19:38

Modified

2025-03-31 17:58

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization
CWE-502 - Deserialization of Untrusted Data

Summary

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.

References

URL

Tags

	https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321	x_refsource_MISC
	https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/	x_refsource_MISC
	https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Sassy Social Share	Sassy Social Share	Version: 3.3.23

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:06:41.490Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-39321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-31T17:58:00.476244Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-31T17:58:03.771Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sassy Social Share",
          "vendor": "Sassy Social Share",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.23"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Chloe Chamberland, Wordfence"
        }
      ],
      "datePublic": "2021-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-21T19:38:52.000Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to version 3.3.24"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Sassy Social Share 3.3.23 PHP Object Injection",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "Wordfence",
          "ASSIGNER": "security@wordfence.com",
          "DATE_PUBLIC": "2021-10-21T16:05:00.000Z",
          "ID": "CVE-2021-39321",
          "STATE": "PUBLIC",
          "TITLE": "Sassy Social Share 3.3.23 PHP Object Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Sassy Social Share",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "3.3.23",
                            "version_value": "3.3.23"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Sassy Social Share"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Chloe Chamberland, Wordfence"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-863 Incorrect Authorization"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502 Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321",
              "refsource": "MISC",
              "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321"
            },
            {
              "name": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/",
              "refsource": "MISC",
              "url": "https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/"
            },
            {
              "name": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php",
              "refsource": "MISC",
              "url": "https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to version 3.3.24"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2021-39321",
    "datePublished": "2021-10-21T19:38:52.886Z",
    "dateReserved": "2021-08-20T00:00:00.000Z",
    "dateUpdated": "2025-03-31T17:58:03.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.