Lucene search

CSWCVE-2021-33851

HistoryMar 10, 2022 - 5:42 p.m.

CVE-2021-33851

2022-03-1017:42:36

CWE-79

CSW

web.nvd.nist.gov

cve-2021-33851

cross-site scripting

xss attack

javascript

arbitrary code

application security

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

30.1%

JSON

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser and can use an application as the vehicle for the attack. The XSS payload given in the “Custom logo link” executes whenever the user opens the Settings Page of the “Customize Login Image” Plugin.

Affected configurations

Nvd

Node

apasionadoscustomize_login_imageMatch3.4wordpress

VendorProductVersionCPE
apasionadoscustomize_login_image3.4cpe:2.3:a:apasionados:customize_login_image:3.4:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
apasionados	customize_login_image	3.4	cpe:2.3:a:apasionados:customize_login_image:3.4:::::wordpress::

CNA Affected

[
  {
    "product": "WordPress Customize Login Image Plugin",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Version 3.4"
      }
    ]
  }
]

References

cybersecurityworks.com/zerodays/cve-2021-33851-stored-cross-site-scripting-in-wordpress-customize-login-image.html

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

30.1%

JSON

Related for CVE-2021-33851