{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-24559", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2021-01-14T15:03:46.768Z", "datePublished": "2024-01-16T15:48:44.511Z", "dateUpdated": "2024-08-03T19:35:20.264Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-01-16T15:48:44.511Z"}, "title": "Qyrr < 0.7 - Authenticated (contributor+) Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Qyrr", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "0.7"}], "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins"}], "descriptions": [{"lang": "en", "value": "The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue."}], "references": [{"url": "https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "dc11", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:35:20.264Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:patrickposner:qyrr:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "0E9662FA-348D-4E17-AE36-5E34C8B218C9", "versionEndExcluding": "0.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue."}, {"lang": "es", "value": "El complemento Qyrr WordPress anterior a 0.7 no escapa del uri de datos del c\u00f3digo QR cuando lo genera en un atributo src, lo que permite ataques de cross site scripting. Adem\u00e1s, la acci\u00f3n data_uri_to_meta AJAX, disponible para todos los usuarios autenticados, solo ten\u00eda una verificaci\u00f3n CSRF implementada, y el nonce disponible para usuarios con un rol tan bajo como Colaborador permite que cualquier usuario con dicho rol (y superior) establezca un dato malicioso. uri en publicaciones de c\u00f3digos QR arbitrarios, lo que genera un problema de cross site scripting almacenado."}], "id": "CVE-2021-24559", "lastModified": "2024-01-23T17:32:47.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-16T16:15:08.953", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}