Lucene search

AppCheckCVELIST:CVE-2024-29832

HistoryMar 26, 2024 - 3:24 p.m.

CVE-2024-29832 WordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_url

2024-03-2615:24:24

AppCheck

www.cve.org

cve-2024

wordpress

photo gallery plugin

unauthenticated

reflected cross site scripting

ajax

admin-ajax.php

gallerybox

current_url

javascript

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue.
Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.

CNA Affected

[
  {
    "vendor": "10Web",
    "product": "PhotoGallery",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "1.0.1",
        "status": "affected",
        "lessThanOrEqual": "1.8.21",
        "versionType": "semver"
      }
    ]
  }
]

References

appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/

wordpress.org/plugins/photo-gallery/#developers

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-29832