Lucene search

Ramuel Gall (WordFence)PATCHSTACK:7D4DC423C2D8661C34960C0F0258B9A0

HistoryOct 13, 2021 - 12:00 a.m.

WordPress Brizy – Page Builder plugin <= 2.3.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

2021-10-1300:00:00

Ramuel Gall (WordFence)

patchstack.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Ramuel Gall (WordFence) in WordPress Brizy – Page Builder plugin (versions <= 2.3.11).

Solution

           Update the WordPress Brizy – Page Builder plugin to the latest available version (at least 2.3.12).

CPENameOperatorVersion
brizy – page builderle2.3.11

CPE	Name	Operator	Version
	brizy – page builder	le	2.3.11

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38344

wordpress.org/plugins/brizy/

www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

Related for PATCHSTACK:7D4DC423C2D8661C34960C0F0258B9A0