CVE-2021-24693

{"id": "CVE-2021-24693", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2021-11-08T18:15:09.007", "references": [{"url": "https://wpscan.com/vulnerability/4bb559b7-8dde-4c90-a9a6-d8dcfbea53a7", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the \"File Thumbnail\" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin"}, {"lang": "es", "value": "El plugin Simple Download Monitor de WordPress versiones anteriores a 3.9.5, no escapa de la meta del post \"File Thumbnail\" antes de mostrarla en algunas p\u00e1ginas, que podr\u00eda permitir a usuarios con un rol tan bajo como el de Contribuyente llevar a cabo ataques de tipo Cross-Site Scripting Almacenado. Dado que el ataque de tipo XSS es desencadenado incluso cuando la descarga est\u00e1 en un estado de revisi\u00f3n, el colaborador podr\u00eda hacer que el c\u00f3digo JavaScript se ejecute en un contexto de un revisor como administrador y hacer que creen una cuenta de administrador falsa, o instalar un plugin malicioso"}], "lastModified": "2021-11-10T20:25:56.657", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tipsandtricks-hq:simple_download_monitor:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "0729EDDD-F3F1-4D92-AF9D-8578773BA210", "versionEndExcluding": "3.9.5"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}