CVE-2021-24164 — Sensitive Information Exposure in Ninja Forms

CWE-200 — Sensitive Information ExposureCWE-862 — Missing Authorization4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 61.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ninjaforms Ninja Forms
Timeline
PublishedApr 5
Latest updateMay 24

Description

In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶NVDninjaforms/ninja_forms< 3.4.34.1

🔴Vulnerability Details

3
GHSA
GHSA-2mcw-g4r6-c9vv: In the Ninja Forms Contact Form WordPress plugin before 3↗2022-05-24
▶
CVEList
Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure↗2021-04-05
▶
VulnCheck
ninjaforms ninja_forms Exposure of Sensitive Information to an Unauthorized Actor↗2021
▶
CVE-2021-24164 — Sensitive Information Exposure | cvebase