CVE-2021-20866

CWE-862 — Missing Authorization3 documents3 sources

Severity

6.5MEDIUM

EPSS

1.2%

top 21.42%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Advancedcustomfields Advanced Custom Fields Delicious Brains Advanced Custom Fields AND Advanced Custom Fields PRO

Timeline

PublishedDec 13

Latest updateDec 14

Description

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDadvancedcustomfields/advanced_custom_fields< 5.11

▶CVEListV5delicious_brains/advanced_custom_fields_and_advanced_custom_fields_proversions prior to 5.11

🔴Vulnerability Details

GHSA

GHSA-gcpg-c569-xfr4: Advanced Custom Fields versions prior to 5↗2021-12-14

▶

CVEList

CVE-2021-20866: Advanced Custom Fields versions prior to 5↗2021-12-13

▶