CVE-2017-20183

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-20183
A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/zzxiang/external-media-without-import/commit/9d2ecd159a6e2e3f710b4f1c28e2714f66502746 Patch
https://github.com/zzxiang/external-media-without-import/releases/tag/v1.0.1 Release Notes
https://vuldb.com/?ctiid.227950 Third Party Advisory
https://vuldb.com/?id.227950 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:external_media_without_import_project:external_media_without_import:*:*:*:*:*:*:*:*
History

11 May 2023, 17:37

Type Values Removed Values Added
CPE cpe:2.3:a:external_media_without_import_project:external_media_without_import:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
References (MISC) https://vuldb.com/?id.227950 - (MISC) https://vuldb.com/?id.227950 - Third Party Advisory
References (MISC) https://github.com/zzxiang/external-media-without-import/releases/tag/v1.0.1 - (MISC) https://github.com/zzxiang/external-media-without-import/releases/tag/v1.0.1 - Release Notes
References (MISC) https://github.com/zzxiang/external-media-without-import/commit/9d2ecd159a6e2e3f710b4f1c28e2714f66502746 - (MISC) https://github.com/zzxiang/external-media-without-import/commit/9d2ecd159a6e2e3f710b4f1c28e2714f66502746 - Patch
References (MISC) https://vuldb.com/?ctiid.227950 - (MISC) https://vuldb.com/?ctiid.227950 - Third Party Advisory

05 May 2023, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-05 01:15

Updated : 2024-05-17 01:17

NVD link : CVE-2017-20183

Mitre link : CVE-2017-20183

CVE.ORG link : CVE-2017-20183

JSON object : View

Products Affected

external_media_without_import_project

  • external_media_without_import
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')