CVE-2021-36832 - Vulnerability Details - OpenCVE

WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Icegram	Icegram Engage

Configuration 1 [-]

cpe:2.3:a:icegram:icegram_engage:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-23408	WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.

Fixes

Solution

Update to 2.0.3 or higher version.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability
https://wordpress.org/plugins/icegram/#developers

History

Tue, 01 Oct 2024 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2021-10-19T14:13:21.105662Z

Updated: 2024-10-01T15:52:44.838Z

Reserved: 2021-07-19T00:00:00

Link: CVE-2021-36832

Vulnrichment

Updated: 2024-08-04T01:01:59.820Z

NVD

Status : Modified

Published: 2021-10-19T15:15:07.637

Modified: 2024-11-21T06:14:10.160

Link: CVE-2021-36832

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram", "vendor": "Icegram", "versions": [{"lessThanOrEqual": "2.0.2", "status": "affected", "version": "<= 2.0.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Original researcher - Asif Nawaz Minhas (Patchstack Red Team)"}], "datePublic": "2021-08-17T00:00:00", "descriptions": [{"lang": "en", "value": "WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram (versions <= 2.0.2) vulnerable at \"Headline\" (&message_data[16][headline]) input."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-19T14:13:21", "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/plugins/icegram/#developers"}, {"tags": ["x_refsource_MISC"], "url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability"}], "solutions": [{"lang": "en", "value": "Update to 2.0.3 or higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2021-08-17T08:22:00.000Z", "ID": "CVE-2021-36832", "STATE": "PUBLIC", "TITLE": "WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram", "version": {"version_data": [{"version_affected": "<=", "version_name": "<= 2.0.2", "version_value": "2.0.2"}]}}]}, "vendor_name": "Icegram"}]}}, "credit": [{"lang": "eng", "value": "Original researcher - Asif Nawaz Minhas (Patchstack Red Team)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram (versions <= 2.0.2) vulnerable at \"Headline\" (&message_data[16][headline]) input."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wordpress.org/plugins/icegram/#developers", "refsource": "CONFIRM", "url": "https://wordpress.org/plugins/icegram/#developers"}, {"name": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability", "refsource": "MISC", "url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability"}]}, "solution": [{"lang": "en", "value": "Update to 2.0.3 or higher version."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:01:59.820Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/plugins/icegram/#developers"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-01T14:23:03.849731Z", "id": "CVE-2021-36832", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T15:52:44.838Z"}}]}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2021-36832", "datePublished": "2021-10-19T14:13:21.105662Z", "dateReserved": "2021-07-19T00:00:00", "dateUpdated": "2024-10-01T15:52:44.838Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wordpress.org/plugins/icegram/#developers", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:01:59.820Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-36832", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-01T14:23:03.849731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-01T14:23:50.887Z"}}], "cna": {"title": "WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Original researcher - Asif Nawaz Minhas (Patchstack Red Team)"}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Icegram", "product": "Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram", "versions": [{"status": "affected", "version": "<= 2.0.2", "versionType": "custom", "lessThanOrEqual": "2.0.2"}]}], "solutions": [{"lang": "en", "value": "Update to 2.0.3 or higher version."}], "datePublic": "2021-08-17T00:00:00", "references": [{"url": "https://wordpress.org/plugins/icegram/#developers", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability", "tags": ["x_refsource_MISC"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram (versions <= 2.0.2) vulnerable at \"Headline\" (&message_data[16][headline]) input."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2021-10-19T14:13:21"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Original researcher - Asif Nawaz Minhas (Patchstack Red Team)"}], "impact": {"cvss": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, "source": {"discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "<= 2.0.2", "version_value": "2.0.2", "version_affected": "<="}]}, "product_name": "Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram"}]}, "vendor_name": "Icegram"}]}}, "solution": [{"lang": "en", "value": "Update to 2.0.3 or higher version."}], "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://wordpress.org/plugins/icegram/#developers", "name": "https://wordpress.org/plugins/icegram/#developers", "refsource": "CONFIRM"}, {"url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability", "name": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram (versions <= 2.0.2) vulnerable at \"Headline\" (&message_data[16][headline]) input."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-36832", "STATE": "PUBLIC", "TITLE": "WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability", "ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2021-08-17T08:22:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2021-36832", "state": "PUBLISHED", "dateUpdated": "2024-10-01T15:52:44.838Z", "dateReserved": "2021-07-19T00:00:00", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2021-10-19T14:13:21.105662Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:icegram:icegram_engage:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "817F9496-3CA8-4F85-A459-23BCEE3A7F05", "versionEndIncluding": "2.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin \u2013 Icegram (versions <= 2.0.2) vulnerable at \"Headline\" (&message_data[16][headline]) input."}, {"lang": "es", "value": "El plugin Popups, Welcome Bar, Optins and Lead Generation de WordPress \u2013 Icegram (versiones anteriores a 2.0.2 incluy\u00e9ndola) es vulnerable en la entrada \"Headline\" (&message_data[16][headline])"}], "id": "CVE-2021-36832", "lastModified": "2024-11-21T06:14:10.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-19T15:15:07.637", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability"}, {"source": "audit@patchstack.com", "tags": ["Product", "Third Party Advisory"], "url": "https://wordpress.org/plugins/icegram/#developers"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://wordpress.org/plugins/icegram/#developers"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}