Strategic Overview
- Status
- Patched in 2.0.8
- Affected Plugin
- Jetpack – WP Security, Backup, Speed, & Growth
- Affected Version
2.0 – < 9.7.1 · 78 branches- CVSS
- 5.3Medium
- Weakness type
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CVE
CVE-2021-24374
At a glance
CVE-2021-24374 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the Jetpack WordPress plugin, affecting versions 2.0 – < 9.7.1 · 78 branches. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 2.0.8; sites on affected versions should update now. Disclosed June 2021.
Vulnerability Overview
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Jetpack 2.0 – < 9.7.1 · 78 branches carries this weakness at carousel, and reaching it takes a caller who can reach the endpoint. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.
The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For Jetpack the fix is 2.0.8: builds 2.0 – < 9.7.1 · 78 branches are affected, anything from 2.0.8 onward is not.
Remediation
Update to one of the following versions, or a newer patched version: 2.0.8, 2.1.6, 2.2.9, 2.3.9, 2.4.6, 2.5.4, 2.6.5, 2.7.4, 2.8.4, 2.9.5, 3.0.5, 3.1.4, 3.2.4, 3.3.5, 3.4.5, 3.5.5, 3.6.3, 3.7.4, 3.8.4, 3.9.8, 4.0.5, 4.1.2, 4.2.3, 4.3.3, 4.4.3, 4.5.1, 4.6.1, 4.7.2, 4.8.3, 4.9.1, 5.0.1, 5.1.2, 5.2.3, 5.3.2, 5.4.2, 5.5.3, 5.6.3, 5.7.3, 5.8.2, 5.9.2, 6.0.2, 6.1.3, 6.2.3, 6.3.5, 6.4.4, 6.5.2, 6.6.3, 6.7.2, 6.8.3, 6.9.2, 7.0.3, 7.1.3, 7.2.3, 7.3.3, 7.4.3, 7.5.5, 7.6.2, 7.7.4, 7.8.2, 7.9.2, 8.0.1, 8.1.2, 8.2.4, 8.3.1, 8.4.3, 8.5.1, 8.6.2, 8.7.2, 8.8.3, 8.9.2, 9.0.3, 9.1.1, 9.2.2, 9.3.3, 9.4.2, 9.5.3, 9.6.2, 9.7.1
How does WordSec protect against this?
The fix is the thing that ends this: Jetpack 2.0.8 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Same weakness class
Other vulnerabilities in Jetpack – WP Security, Backup, Speed, & Growth
- 9.8Jetpack – WP Security, Backup, Speed, & Growth < 4.2 Timing Attack
- 9.6Jetpack – WP Security, Backup, Speed, & Growth < 4.2 CSV Injection
- 7.2Jetpack 12.0 - 16.1.2 PHP Object Injection
- 7.2Jetpack <= 3.7.1 Stored Cross-Site Scripting
- 7.2Jetpack <= 3.5.2 Cross-Site Scripting
- 6.6Jetpack PHP Object Injection
- 6.5CVE-2024-10075: Jetpack <= 13.7 Arbitrary Block & Shortcode Execution
CVE-2024-10075 - 6.5CVE-2023-2996: Jetpack <= 12.1 Arbitrary File Manipulation
CVE-2023-2996
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C