CVE-2021-24559

The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:patrickposner:qyrr:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-01-16 16:15

Updated : 2024-01-23 17:32

NVD link : CVE-2021-24559

Mitre link : CVE-2021-24559

CVE.ORG link : CVE-2021-24559

JSON object : View

Products Affected

patrickposner

qyrr

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-24559", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-01-16T16:15:08.953", "references": [{"url": "https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue."}, {"lang": "es", "value": "El complemento Qyrr WordPress anterior a 0.7 no escapa del uri de datos del c\u00f3digo QR cuando lo genera en un atributo src, lo que permite ataques de cross site scripting. Adem\u00e1s, la acci\u00f3n data_uri_to_meta AJAX, disponible para todos los usuarios autenticados, solo ten\u00eda una verificaci\u00f3n CSRF implementada, y el nonce disponible para usuarios con un rol tan bajo como Colaborador permite que cualquier usuario con dicho rol (y superior) establezca un dato malicioso. uri en publicaciones de c\u00f3digos QR arbitrarios, lo que genera un problema de cross site scripting almacenado."}], "lastModified": "2024-01-23T17:32:47.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:patrickposner:qyrr:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "0E9662FA-348D-4E17-AE36-5E34C8B218C9", "versionEndExcluding": "0.7"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}