ByteOS Network

NVD Vulnerability Details :

CVE-2021-39339

Analyzed

Source-security@wordfence.com

Published At-22 Sep, 2021 | 11:15

Updated At-02 Oct, 2021 | 02:09

The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request value that gets called by a curl requests. This affects versions up to, and including, 1.8.0.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Secondary	3.1	5.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P

CPE Matches

telefication>>telefication>>Versions up to 1.8.0(inclusive)

cpe:2.3:a:telefication:telefication:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Primary	security@wordfence.com

References

Hyperlink	Source	Resource
https://plugins.trac.wordpress.org/browser/telefication/tags/1.8.0/bypass.php	security@wordfence.com	Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39339	security@wordfence.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History