CVE-2021-24166

Description


The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.

CvssV3 impact


BaseSeverity

MEDIUM

ConfidentialityImpact

NONE

AttackComplexity

LOW

Scope

UNCHANGED

AttackVector

NETWORK

AvailabilityImpact

LOW

IntegrityImpact

LOW

PrivilegesRequired

NONE

BaseScore

5.4

VectorString

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Version

3.1

UserInteraction

REQUIRED

CvssV2 impact


AccessComplexity

MEDIUM

ConfidentialityImpact

NONE

AvailabilityImpact

PARTIAL

IntegrityImpact

PARTIAL

BaseScore

5.8

VectorString

AV:N/AC:M/Au:N/C:N/I:P/A:P

Version

2.0

AccessVector

NETWORK

Authentication

NONE