Back to feed
EUVD-2021-11587 · Published Oct 18, 2021
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
Technologies
Onedesigns One User Avatar
Weaknesses
CWE-352
CVSS scores
- v3.16.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - v2.04.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
