CVE-2021-24408

{"id": "CVE-2021-24408", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-07-12T20:15:08.720", "references": [{"url": "https://wpscan.com/vulnerability/51855853-e7bd-425f-802c-824209f4f84d", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability."}, {"lang": "es", "value": "El plugin Prismatic de WordPress versiones anteriores a 2.8, no sanea o comprueba algunos de sus par\u00e1metros shortcode, permitiendo a usuarios con un rol tan bajo como el de colaborador ajustar carga \u00fatil de tipo Cross-Site en ellos. Un post hecho por un colaborador todav\u00eda tendr\u00eda que ser aprobado por un administrador para que el ataque XSS se desencadene en el frontend, sin embargo, los usuarios con mayores privilegios, como el editor podr\u00edan explotar esto sin necesidad de aprobaci\u00f3n, e incluso cuando el blog deshabilita la capacidad unfiltered_html"}], "lastModified": "2021-07-15T14:33:56.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:plugin-planet:prismatic:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "C7241475-3772-4014-9F8C-53F686FF4FBD", "versionEndExcluding": "2.8"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}