CVE-2021-24642

The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://wpscan.com/vulnerability/8d9129ab-33c3-44ee-b150-f7552d88e658	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:scroll_banner_project:scroll_banner:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2021-10-18 14:15

Updated : 2022-11-09 21:50

NVD link : CVE-2021-24642

Mitre link : CVE-2021-24642

CVE.ORG link : CVE-2021-24642

JSON object : View

Products Affected

scroll_banner_project

scroll_banner

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-24642", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-10-18T14:15:09.437", "references": [{"url": "https://wpscan.com/vulnerability/8d9129ab-33c3-44ee-b150-f7552d88e658", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS"}, {"lang": "es", "value": "El plugin Scroll Baner de WordPress versiones hasta 1.0, no presenta una comprobaci\u00f3n de tipo CSRF cuando guarda sus configuraciones, ni lleva a cabo ning\u00fan tipo de saneo, escape o comprobaci\u00f3n de las mismas. Esto podr\u00eda permitir a atacantes hacer que los administradores registrados los cambien y podr\u00eda conllevar a RCE (por medio de una carga de archivos) as\u00ed como un ataque de tipo XSS"}], "lastModified": "2022-11-09T21:50:30.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:scroll_banner_project:scroll_banner:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "57316231-3178-438F-8896-753A50EF7843", "versionEndIncluding": "1.0"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}