CVE-2021-24246 - OpenCVE

The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Purethemes	Workscout Workscout Core

Configuration 1 [-]

OR	cpe:2.3:a:purethemes:workscout::::::wordpress::*
	cpe:2.3:a:purethemes:workscout_core::::::wordpress::*

No data.

References

Link	Providers
https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-WorkScout-WordPress-Theme-v2.0.33.txt
https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d

History

No history.

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2021-05-05T18:39:43

Updated: 2024-08-03T19:21:18.683Z

Reserved: 2021-01-14T00:00:00

Link: CVE-2021-24246

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-05-06T13:15:11.563

Modified: 2023-11-07T03:31:08.767

Link: CVE-2021-24246

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Workscout Core", "vendor": "PureThemes", "versions": [{"lessThan": "1.3.4", "status": "affected", "version": "1.3.4", "versionType": "custom"}]}, {"product": "WorkScout", "vendor": "PureThemes", "versions": [{"lessThan": "2.0.33", "status": "affected", "version": "2.0.33", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "m0ze"}], "descriptions": [{"lang": "en", "value": "The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-05-05T18:39:43", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d"}, {"tags": ["x_refsource_MISC"], "url": "https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-WorkScout-WordPress-Theme-v2.0.33.txt"}], "source": {"discovery": "UNKNOWN"}, "title": "WorkScout Core < 1.3.4 - Authenticated Stored XSS & XFS", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2021-24246", "STATE": "PUBLIC", "TITLE": "WorkScout Core < 1.3.4 - Authenticated Stored XSS & XFS"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Workscout Core", "version": {"version_data": [{"version_affected": "<", "version_name": "1.3.4", "version_value": "1.3.4"}]}}, {"product_name": "WorkScout", "version": {"version_data": [{"version_affected": "<", "version_name": "2.0.33", "version_value": "2.0.33"}]}}]}, "vendor_name": "PureThemes"}]}}, "credit": [{"lang": "eng", "value": "m0ze"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d", "refsource": "CONFIRM", "url": "https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d"}, {"name": "https://m0ze.ru/vulnerability/[2021-02-10]-[WordPress]-[CWE-79]-WorkScout-WordPress-Theme-v2.0.33.txt", "refsource": "MISC", "url": "https://m0ze.ru/vulnerability/[2021-02-10]-[WordPress]-[CWE-79]-WorkScout-WordPress-Theme-v2.0.33.txt"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:21:18.683Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-WorkScout-WordPress-Theme-v2.0.33.txt"}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2021-24246", "datePublished": "2021-05-05T18:39:43", "dateReserved": "2021-01-14T00:00:00", "dateUpdated": "2024-08-03T19:21:18.683Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:purethemes:workscout:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "82D7C34A-B4FB-404C-85BF-F85D6AB014E7", "versionEndExcluding": "2.0.33", "vulnerable": true}, {"criteria": "cpe:2.3:a:purethemes:workscout_core:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "AC793014-6634-4B1A-9873-849AE359E110", "versionEndExcluding": "1.3.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues"}, {"lang": "es", "value": "El plugin Workscout Core WordPress versiones anteriores a 1.3.4, utilizado por el Tema WorkScout, no saneaba los mensajes de chat enviados por medio de la acci\u00f3n workscout_send_message_chat AJAX, conllevando a problemas de tipo Cross-Site Scripting Almacenados y Cross-Frame Scripting"}], "id": "CVE-2021-24246", "lastModified": "2023-11-07T03:31:08.767", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-05-06T13:15:11.563", "references": [{"source": "contact@wpscan.com", "url": "https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-WorkScout-WordPress-Theme-v2.0.33.txt"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Primary"}]}