4.8
CVE-2021-24427
- EPSS 0.42%
- Veröffentlicht 12.07.2021 20:15:09
- Zuletzt bearbeitet 21.11.2024 05:53:03
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginW3 Total Cache < 2.1.3 - Authenticated Stored XSS
W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue
Mögliche Gegenmaßnahme
W3 Total Cache: Update to version 2.1.3, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Boldgrid ≫ W3 Total Cache SwPlatformwordpress Version < 2.1.3
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
W3 Total Cache
Version
[*, 2.1.3)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.42% | 0.614 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.