Vulnerabilities > CVE-2021-38345 - Incorrect Authorization vulnerability in Brizy Brizy-Page Builder

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

brizy

CWE-863

NVD

Published: 2021-10-14

Updated: 2022-10-27

Summary

The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.

Vulnerable Configurations

Part	Description	Count
Application	Brizy Brizy Brizy Page Builder 1.0.1.125 Brizy Brizy Page Builder 1.0.127 Brizy Brizy Page Builder 2.0.1 Brizy Brizy Page Builder 2.0.2 Brizy Brizy Page Builder 2.0.3 Brizy Brizy Page Builder 2.0.4 Brizy Brizy Page Builder 2.0.5 Brizy Brizy Page Builder 2.0.6 Brizy Brizy Page Builder 2.0.7 Brizy Brizy Page Builder 2.0.8 Brizy Brizy Page Builder 2.0.9 Brizy Brizy Page Builder 2.0.10 Brizy Brizy Page Builder 2.0.12 Brizy Brizy Page Builder 2.0.13 Brizy Brizy Page Builder 2.0.14 Brizy Brizy Page Builder 2.0.15 Brizy Brizy Page Builder 2.0.16 Brizy Brizy Page Builder 2.1.0 Brizy Brizy Page Builder 2.1.2 Brizy Brizy Page Builder 2.1.3 Brizy Brizy Page Builder 2.1.4 Brizy Brizy Page Builder 2.1.5 Brizy Brizy Page Builder 2.2.0 Brizy Brizy Page Builder 2.2.1 Brizy Brizy Page Builder 2.2.2 Brizy Brizy Page Builder 2.2.3 Brizy Brizy Page Builder 2.2.4 Brizy Brizy Page Builder 2.2.5 Brizy Brizy Page Builder 2.2.6 Brizy Brizy Page Builder 2.2.7 Brizy Brizy Page Builder 2.2.8 Brizy Brizy Page Builder 2.2.9.1 Brizy Brizy Page Builder 2.2.10 Brizy Brizy Page Builder 2.2.11 Brizy Brizy Page Builder 2.2.12 Brizy Brizy Page Builder 2.2.13 Brizy Brizy Page Builder 2.2.14 Brizy Brizy Page Builder 2.2.15 Brizy Brizy Page Builder 2.2.16 Brizy Brizy Page Builder 2.2.17 Brizy Brizy Page Builder 2.2.18 Brizy Brizy Page Builder 2.2.19 Brizy Brizy Page Builder 2.2.20 Brizy Brizy Page Builder 2.3.0 Brizy Brizy Page Builder 2.3.1 Brizy Brizy Page Builder 2.3.2 Brizy Brizy Page Builder 2.3.3 Brizy Brizy Page Builder 2.3.4 Brizy Brizy Page Builder 2.3.5 Brizy Brizy Page Builder 2.3.6 Brizy Brizy Page Builder 2.3.7 Brizy Brizy Page Builder 2.3.8 Brizy Brizy Page Builder 2.3.9 Brizy Brizy Page Builder 2.3.10 Brizy Brizy Page Builder 2.3.11	56

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

References

https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/