6.1
CVE-2021-24349
- EPSS 0.41%
- Veröffentlicht 14.06.2021 14:15:08
- Zuletzt bearbeitet 21.11.2024 05:52:53
- CVE-Watchlists
- Unerledigt
LoginGallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS)
Gallery from files <= 1.60 - Reflected Cross-Site Scripting
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.
Mögliche Gegenmaßnahme
Gallery from files: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gallery From Files Project ≫ Gallery From Files SwPlatformwordpress Version <= 1.6.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Gallery from files
Version
*-1.60
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.41% | 0.327 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://wpscan.com/vulnerability/6bb4eb71-d702-4732-b01f-b723077d66ca
https://www.wordfence.com/threat-intel/vulnerabilities/id/d76b08c3-0d28-4e81-8843-5afded9efaa6