Lucene search

WPScanCVE-2021-24658

HistoryAug 23, 2021 - 12:15 p.m.

CVE-2021-24658

2021-08-2312:15:10

CWE-79

WPScan

web.nvd.nist.gov

cve-2021-24658

erident custom login

dashboard

wordpress

plugin

xss

security vulnerability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)

Affected configurations

Nvd

Vulners

Node

erident_custom_login_and_dashboard_projecterident_custom_login_and_dashboardRange<3.5.9wordpress

VendorProductVersionCPE
erident_custom_login_and_dashboard_projecterident_custom_login_and_dashboard*cpe:2.3:a:erident_custom_login_and_dashboard_project:erident_custom_login_and_dashboard:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
erident_custom_login_and_dashboard_project	erident_custom_login_and_dashboard	*	cpe:2.3:a:erident_custom_login_and_dashboard_project:erident_custom_login_and_dashboard::::::wordpress::*

CNA Affected

[
  {
    "product": "Erident Custom Login and Dashboard",
    "vendor": "Libin V Babu",
    "versions": [
      {
        "lessThan": "3.5.9",
        "status": "affected",
        "version": "3.5.9",
        "versionType": "custom"
      }
    ]
  }
]

References

plugins.trac.wordpress.org/changeset/2507516

wpscan.com/vulnerability/ec70f02b-02a1-4511-949e-68f2d9d37ca8

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2021-24658