Lucene search

M0ze (Patchstack Red Team)PATCHSTACK:3A162410AFA346C25FF9ACAB0488D969

HistoryMay 19, 2021 - 12:00 a.m.

WordPress JobSearch premium plugin <= 1.7.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

2021-05-1900:00:00

m0ze (Patchstack Red Team)

patchstack.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress JobSearch premium plugin (versions <= 1.7.3).

Solution

           Update the WordPress JobSearch premium plugin to the latest available version (at least 1.7.4).

CPENameOperatorVersion
jobsearchle1.7.3

CPE	Name	Operator	Version
	jobsearch	le	1.7.3

References

codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24421

m0ze.ru/vulnerability/[2021-05-19]-[WordPress]-[CWE-79]-WP-JobSearch-WordPress-Plugin-v1.7.3.txt

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

Related for PATCHSTACK:3A162410AFA346C25FF9ACAB0488D969