CVE-2021-24226
N/A
N/A
Summary
In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | AccessAlly | 3.5.6 < 3.5.6* | affected |
| Unknown | AccessAlly | 3.5.7 < 3.5.7 | affected |
Weaknesses
- CWE-200: CWE-200 Information Exposure
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.