CVE-2021-24539

{"id": "CVE-2021-24539", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2021-11-01T09:15:08.447", "references": [{"url": "https://wpscan.com/vulnerability/4bda5dff-f577-4cd8-a225-c6b4c32f22b4", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/4bda5dff-f577-4cd8-a225-c6b4c32f22b4", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue"}, {"lang": "es", "value": "El plugin Coming Soon, Under Construction & Maintenance Mode By Dazzler de WordPress versiones anteriores a 1.6.7, no sanea ni escapa de su ajuste de descripci\u00f3n cuando se muestra en el frontend cuando el modo Coming Soon est\u00e1 habilitado, incluso cuando la capacidad unfiltered_html no est\u00e1 permitida, conllevando a un problema de tipo Cross-Site Scripting Almacenado autenticado"}], "lastModified": "2024-11-21T05:53:15.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dazzlersoftware:coming_soon\\,_under_construction_\\&_maintenance_mode_by_dazzler:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "B55917D4-3060-40B3-B518-E4F92CBE8C23", "versionEndExcluding": "1.6.7"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}