Vulnerabilities > CVE-2021-24318 - Authorization Bypass Through User-Controlled Key vulnerability in Purethemes Listeo

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

purethemes

CWE-639

NVD

Published: 2021-06-01

Updated: 2022-10-25

Summary

The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authenticated users to delete arbitrary page/post and booking via an IDOR vector.

Vulnerable Configurations

Part	Description	Count
Application	Purethemes Purethemes Listeo 1.0.0 Purethemes Listeo 1.0.1 Purethemes Listeo 1.0.2 Purethemes Listeo 1.0.3 Purethemes Listeo 1.0.7 Purethemes Listeo 1.0.8 Purethemes Listeo 1.0.9 Purethemes Listeo 1.1.0 Purethemes Listeo 1.1.1 Purethemes Listeo 1.1.3 Purethemes Listeo 1.1.4 Purethemes Listeo 1.1.5 Purethemes Listeo 1.1.6 Purethemes Listeo 1.1.7 Purethemes Listeo 1.1.9 Purethemes Listeo 1.2 Purethemes Listeo 1.2.3 Purethemes Listeo 1.2.4 Purethemes Listeo 1.2.5 Purethemes Listeo 1.2.7 Purethemes Listeo 1.2.9 Purethemes Listeo 1.3 Purethemes Listeo 1.3.3 Purethemes Listeo 1.3.4 Purethemes Listeo 1.3.5 Purethemes Listeo 1.3.6 Purethemes Listeo 1.3.8 Purethemes Listeo 1.4 Purethemes Listeo 1.4.1 Purethemes Listeo 1.4.2 Purethemes Listeo 1.4.3 Purethemes Listeo 1.4.4 Purethemes Listeo 1.4.5 Purethemes Listeo 1.4.6 Purethemes Listeo 1.5 Purethemes Listeo 1.5.03 Purethemes Listeo 1.5.04 Purethemes Listeo 1.5.05 Purethemes Listeo 1.5.06 Purethemes Listeo 1.5.07 Purethemes Listeo 1.5.08 Purethemes Listeo 1.6 Purethemes Listeo 1.6.06 Purethemes Listeo 1.6.07	44

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References