CVE-2021-24347
Published: 14 June 2021
Summary
CVE-2021-24347 is a high-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Smartypantsplugins Sp Project \& Document Manager. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-11260
Vulnerability details
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file…
more
extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.