Skip to main content

Mstore Api CVE-2021-24148

CRITICAL
Improper Authentication (CWE-287)
2021-03-18 contact@wpscan.com
WordPress Apple Authentication Bypass Mstore Api
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 18, 2021 - 15:15 nvd
CRITICAL 9.8

DescriptionNVD

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.

AnalysisAI

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. Affected products include: Inspireui Mstore Api. Version information: before 3.2.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.

More in Mstore Api

View all
CVE-2023-2732 CRITICAL POC
9.8 May 25

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. Rate
CVE-2023-2734 CRITICAL POC
9.8 May 25

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. Rate
CVE-2023-3277 CRITICAL POC
9.8 Nov 03

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up
CVE-2023-3197 CRITICAL POC
9.8 Jun 24

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versi
CVE-2020-36713 CRITICAL POC
9.8 Jun 07

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. Rate
CVE-2023-3077 CRITICAL POC
9.8 Jul 10

The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement
CVE-2023-3076 CRITICAL POC
9.8 Jul 10

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of thei
CVE-2024-6328 CRITICAL
9.8 Jul 12

The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypa
CVE-2023-2733 CRITICAL
9.8 May 25

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. Rate
CVE-2024-8242 HIGH
8.8 Sep 13

The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uplo
CVE-2023-3131 MEDIUM POC
4.3 Jul 10

The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks,

CVE-2024-7628 HIGH
8.1 Aug 15

The MStore API - Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypa

Same weakness CWE-287 – Improper Authentication

View all
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8
CVE-2024-53704 CRITICAL POC
9.8
CVE-2015-7755 CRITICAL POC
9.8
CVE-2013-0625 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2021-24148 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy