exploitDog

CVE-2021-24965

Опубликовано: 24 янв. 2022

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins

Ссылки

https://wpscan.com/vulnerability/306ecf09-fdf0-449c-930c-9dfa58f0efc2
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/306ecf09-fdf0-449c-930c-9dfa58f0efc2
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:fivestarplugins:five_star_restaurant_reservations:*:*:*:*:*:wordpress:*:*

Версия до 2.4.8 (исключая)

EPSS

Процентиль: 43%

0.00208

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-fvjh-pxch-48xx

github

около 4 лет назад

The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins

EPSS

Процентиль: 43%

0.00208

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79