Lucene search

WPScanCVE-2021-24605

HistorySep 13, 2021 - 6:15 p.m.

CVE-2021-24605

2021-09-1318:15:16

CWE-79

WPScan

web.nvd.nist.gov

cve-2021-24605

custom post view generator

wordpress

ajax

reflected cross-site

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue

Affected configurations

Nvd

Vulners

Node

custom_post_view_generator_projectcustom_post_view_generatorRange≤0.4.6wordpress

VendorProductVersionCPE
custom_post_view_generator_projectcustom_post_view_generator*cpe:2.3:a:custom_post_view_generator_project:custom_post_view_generator:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
custom_post_view_generator_project	custom_post_view_generator	*	cpe:2.3:a:custom_post_view_generator_project:custom_post_view_generator::::::wordpress::*

CNA Affected

[
  {
    "product": "Custom Post View Generator",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "0.4.6",
        "status": "affected",
        "version": "0.4.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/e0be384c-3e63-49f6-b2ab-3024dcd88686

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2021-24605