CVE-2022-2101

2022-07-1816:13:21

Wordfence

www.cve.org

wordpress download manager

stored cross-site scripting

input sanitization

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

61.3%

JSON

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file[files][] parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file’s page that will execute whenever an administrator accesses the editor area for the injected file page.

CNA Affected

[
  {
    "vendor": "codename065",
    "product": "Download Manager",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.2.46",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

medium.com/%40andreabocchetti88/download-manager-3-2-43-contributor-cross-site-scripting-fa4970fba45c

packetstormsecurity.com/files/167573/

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2750339%40download-manager&new=2750339%40download-manager&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/b399929a-db33-419f-9218-b86ee88a9f1a?source=cve

www.wordfence.com/vulnerability-advisories/#CVE-2022-2101