by Kastro
Paper/Archive/CVE-2021-24148

CVE-2021-24148

Unknown MStore API — MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.8.888 × 2017.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

Affected

ProductAffectedFixed inSource
MStore API3.2.0 – < 3.2.03.2.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882