The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/e4ba26b4-5f4f-4c9e-aa37-885b30ef8088/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/e4ba26b4-5f4f-4c9e-aa37-885b30ef8088/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 09:48
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) El complemento sitetweet de WordPress hasta la versión 0.2 no tiene control CSRF en algunos lugares y le falta desinfección y escape, lo que podría permitir a los atacantes hacer que el administrador que haya iniciado sesión agregue payloads XSS almacenado a través de un ataque CSRF. | |
| References | () https://wpscan.com/vulnerability/e4ba26b4-5f4f-4c9e-aa37-885b30ef8088/ - Exploit, Third Party Advisory |
03 Jul 2024, 15:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sitetweet Project
Sitetweet Project sitetweet |
|
| References | () https://wpscan.com/vulnerability/e4ba26b4-5f4f-4c9e-aa37-885b30ef8088/ - Exploit, Third Party Advisory | |
| CWE | CWE-352 | |
| CPE | cpe:2.3:a:sitetweet_project:sitetweet:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
02 Jul 2024, 12:09
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
02 Jul 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-02 06:15
Updated : 2024-11-21 09:48
NVD link : CVE-2024-5767
Mitre link : CVE-2024-5767
CVE.ORG link : CVE-2024-5767
JSON object : View
Products Affected
sitetweet_project
- sitetweet
CWE
CWE-352
Cross-Site Request Forgery (CSRF)