Lucene search

WordfenceCVE-2022-2101

HistoryJul 18, 2022 - 5:15 p.m.

CVE-2022-2101

2022-07-1817:15:08

Wordfence

web.nvd.nist.gov

wordpress

download manager

plugin

security

vulnerability

cve-2022-2101

xss

nvd

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file[files][] parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file’s page that will execute whenever an administrator accesses the editor area for the injected file page.

Affected configurations

Nvd

Vulners

Node

wpdownloadmanagerwordpress_download_managerRange≤3.2.46wordpress

VendorProductVersionCPE
wpdownloadmanagerwordpress_download_manager*cpe:2.3:a:wpdownloadmanager:wordpress_download_manager:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpdownloadmanager	wordpress_download_manager	*	cpe:2.3:a:wpdownloadmanager:wordpress_download_manager::::::wordpress::*

CNA Affected

[
  {
    "vendor": "codename065",
    "product": "Download Manager",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.2.46",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

medium.com/%40andreabocchetti88/download-manager-3-2-43-contributor-cross-site-scripting-fa4970fba45c

packetstormsecurity.com/files/167573/

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2750339%40download-manager&new=2750339%40download-manager&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/b399929a-db33-419f-9218-b86ee88a9f1a?source=cve

www.wordfence.com/vulnerability-advisories/#CVE-2022-2101