CVE-2021-4361

CWE-284 — Improper Access ControlCWE-862 — Missing Authorization3 documents3 sources
Severity
8.8HIGH
EPSS
0.3%
top 50.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Eyecix Jobsearch WP JOB Board
Timeline
PublishedJun 7

Description

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update↗2023-06-07
▶
GHSA
GHSA-jvpp-jchv-3vjq: The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrati↗2023-06-07
▶
CVE-2021-4361 (HIGH CVSS 8.8) | The JobSearch WP Job Board plugin f | cvebase.io