5.5

CVE-2021-39332

Business Manager – WordPress ERP, HR, CRM, and Project Management Plugin <= 1.4.5 Authenticated Stored Cross-Site Scripting

Business Manager <= 1.4.5 - Stored Cross-Site Scripting

The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Mögliche Gegenmaßnahme
WordPress ERP, HR, CRM, and Project Management Plugin – Business Manager: Update to version 1.4.6, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bzmngr ≫ Business Manager SwPlatformwordpress Version <= 1.4.5
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WordPress ERP, HR, CRM, and Project Management Plugin – Business Manager
Version *-1.4.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.392
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:N/AC:H/Au:S/C:N/I:P/A:N
security@wordfence.com 5.5 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39332
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/94cbd525-de3b-448a-b65b-21c63208b8b8
Third Party Advisory