← Voltar para CVEs

CVE-2021-24558

MEDIUM

5.4

Descricao

The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue

Detalhes CVE

Pontuacao CVSS v3.15.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado8/23/2021

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

3.7designs:project_status

Fraquezas (CWE)

CWE-79CWE-79

Referencias

https://codevigilant.com/disclosure/2021/wp-plugin-project-status/(contact@wpscan.com)

https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff(contact@wpscan.com)

https://codevigilant.com/disclosure/2021/wp-plugin-project-status/(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.