CVE-2021-20865 — Missing Authorization in Advanced Custom Fields

CWE-862 — Missing Authorization3 documents3 sources
Severity
7.5HIGHNVD
EPSS
1.9%
top 16.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Advancedcustomfields Advanced Custom FieldsDelicious Brains Advanced Custom Fields AND Advanced Custom Fields PRO
Timeline
PublishedDec 13
Latest updateDec 14

Description

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-f2fc-p952-6xf6: Advanced Custom Fields versions prior to 5↗2021-12-14
▶
CVEList
CVE-2021-20865: Advanced Custom Fields versions prior to 5↗2021-12-13
▶
CVE-2021-20865 — Missing Authorization | cvebase