Lucene search

WPScanCVE-2021-25113

HistoryApr 04, 2022 - 4:15 p.m.

CVE-2021-25113

2022-04-0416:15:08

CWE-79

WPScan

web.nvd.nist.gov

cve-2021-25113

wordpress plugin

authorization bypass

csrf

stored xss

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Affected configurations

Nvd

Vulners

Node

dropdown_menu_widget_projectdropdown_menu_widgetRange≤1.9.7wordpress

VendorProductVersionCPE
dropdown_menu_widget_projectdropdown_menu_widget*cpe:2.3:a:dropdown_menu_widget_project:dropdown_menu_widget:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
dropdown_menu_widget_project	dropdown_menu_widget	*	cpe:2.3:a:dropdown_menu_widget_project:dropdown_menu_widget::::::wordpress::*

CNA Affected

[
  {
    "product": "Dropdown Menu Widget",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.9.7",
        "status": "affected",
        "version": "1.9.7",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/7a5078db-e0d4-4076-9de9-5401c3ca0d65

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2021-25113