ByteOS Network

NVD Vulnerability Details :

CVE-2021-24487

Analyzed

Source-contact@wpscan.com

Published At-25 Oct, 2021 | 14:15

Updated At-15 Feb, 2023 | 02:30

The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

sanskruti>>st-daily-tip>>Versions up to 4.7(inclusive)

cpe:2.3:a:sanskruti:st-daily-tip:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-352	Primary	contact@wpscan.com
CWE-79	Primary	contact@wpscan.com
CWE-352	Secondary	nvd@nist.gov
CWE-79	Secondary	nvd@nist.gov

CWE ID: CWE-352

Type: Primary

Source: contact@wpscan.com

CWE ID: CWE-79

Type: Primary

Source: contact@wpscan.com

CWE ID: CWE-352

Type: Secondary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://wpscan.com/vulnerability/def352f8-1bbe-4263-ad1a-1486140269f4	contact@wpscan.com	Exploit Third Party Advisory

Hyperlink: https://wpscan.com/vulnerability/def352f8-1bbe-4263-ad1a-1486140269f4

Source: contact@wpscan.com

Resource:

Exploit

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History