Riskcovery

CVE-2021-24472

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF

State
Published
Severity
Not scored
Published
Aug 2, 2021
Updated
Aug 3, 2024
Reserved
Jan 14, 2021

Read the record on cve.org

Description

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
QT KenthaRadioQantumThemes
  • 2.0.2 to before 2.0.2Affected
OnAir2QantumThemes
  • 3.9.9.2 to before 3.9.9.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.