CVE-2021-24970: All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion
Published Dec 13, 2021
·Updated
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
Affected Software
1 affected component
Plugins360 All-in-one Video Gallery Wordpress<2.5.0
Event History
Dec 13, 2021
CVE Published
via MITRE·10:41 AM
Data Sourced
via MITRE·10:41 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-24970?
CVE-2021-24970 has a moderate severity level due to its potential for Local File Inclusion vulnerabilities.
2
How do I fix CVE-2021-24970?
To fix CVE-2021-24970, update the All-in-One Video Gallery plugin to version 2.5.0 or later.
3
What impact does CVE-2021-24970 have on my WordPress site?
CVE-2021-24970 can allow attackers to include arbitrary files on your server, leading to sensitive information exposure or code execution.
4
Is CVE-2021-24970 being actively exploited?
As of now, there have been no confirmed active exploits specific to CVE-2021-24970.
5
Which versions of the All-in-One Video Gallery plugin are affected by CVE-2021-24970?
CVE-2021-24970 affects all versions of the All-in-One Video Gallery plugin prior to 2.5.0.