CVE-2021-24545

{"id": "CVE-2021-24545", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-10-11T11:15:08.633", "references": [{"url": "https://wpscan.com/vulnerability/64267134-9d8c-4e0c-b24f-d18692a5775e", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/64267134-9d8c-4e0c-b24f-d18692a5775e", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s."}, {"lang": "es", "value": "El plugin WP HTML Author Bio de WordPress versiones hasta 1.2.0, no sanea el HTML permitido en la Bio de los usuarios, permitiendo que estos usen c\u00f3digo JavaScript malicioso, que ser\u00e1 ejecutado cuando alguien visite un post en el frontend realizado por dicho usuario. Como resultado, un usuario con un rol tan bajo como el de autor podr\u00eda llevar a cabo ataques de tipo Cross-Site Scripting contra usuarios, lo que potencialmente podr\u00eda llevar a una escalada de privilegios cuando un administrador vea el/los post/s relacionados"}], "lastModified": "2024-11-21T05:53:16.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wp_html_author_bio_project:wp_html_author_bio:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "53D2F04F-6C82-4C8D-8178-5D2CD8217EFC", "versionEndIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}