CVE-2021-24145

Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

State: Published
Severity: Not scored
Published: Mar 18, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.

Scores

The record has no CVSS score.

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
Modern Events Calendar LiteUnknown	5.16.5 to before 5.16.5Affected

References

https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html
http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.