CVE-2021-24823

CVE-2021-24823: Support Board < 3.3.6 - Arbitrary File Deletion via CSRF

Vendor Unknown

Product Support Board

Weakness CWE-352 · CSRF

Published February 28, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files

Key dates

02Disclosure timeline

February 28, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24823 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html