CVE-2024-8983 - OpenCVE

Custom Twitter Feeds WordPress plugin before 2.2.3 is not filtering some of its settings allowing high privilege users to inject scripts.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Smashballoon	Custom Twitter Feeds

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33/

History

Wed, 09 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Smashballoon Smashballoon custom Twitter Feeds
CPEs		cpe:2.3:a:smashballoon:custom_twitter_feeds::::::wordpress::*
Vendors & Products		Smashballoon Smashballoon custom Twitter Feeds
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 08 Oct 2024 06:15:00 +0000

Type	Values Removed	Values Added
Description		Custom Twitter Feeds WordPress plugin before 2.2.3 is not filtering some of its settings allowing high privilege users to inject scripts.
Title		Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS
References		https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-10-08T06:00:03.744Z

Updated: 2024-10-09T15:17:17.144Z

Reserved: 2024-09-18T19:23:38.003Z

Link: CVE-2024-8983

Vulnrichment

Updated: 2024-10-09T15:17:11.448Z

NVD

Status : Awaiting Analysis

Published: 2024-10-08T06:15:02.490

Modified: 2024-10-10T12:57:21.987

Link: CVE-2024-8983

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8983", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-09-18T19:23:38.003Z", "datePublished": "2024-10-08T06:00:03.744Z", "dateUpdated": "2024-10-09T15:17:17.144Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-10-08T06:00:03.744Z"}, "title": "Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Custom Twitter Feeds", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.2.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Custom Twitter Feeds WordPress plugin before 2.2.3 is not filtering some of its settings allowing high privilege users to inject scripts."}], "references": [{"url": "https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Krugov Artyom", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"affected": [{"vendor": "smashballoon", "product": "custom_twitter_feeds", "cpes": ["cpe:2.3:a:smashballoon:custom_twitter_feeds:*:*:*:*:*:wordpress:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.2.3", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-09T15:14:53.233674Z", "id": "CVE-2024-8983", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-09T15:17:17.144Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-8983", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-09T15:14:53.233674Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:smashballoon:custom_twitter_feeds:*:*:*:*:*:wordpress:*:*"], "vendor": "smashballoon", "product": "custom_twitter_feeds", "versions": [{"status": "affected", "version": "0", "lessThan": "2.2.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-09T15:17:11.448Z"}}], "cna": {"title": "Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Krugov Artyom"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Custom Twitter Feeds", "versions": [{"status": "affected", "version": "0", "lessThan": "2.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/29194dde-8d11-4096-a5ae-1d69c2c5dc33/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "Custom Twitter Feeds WordPress plugin before 2.2.3 is not filtering some of its settings allowing high privilege users to inject scripts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Cross-Site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-10-08T06:00:03.744Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8983", "state": "PUBLISHED", "dateUpdated": "2024-10-09T15:17:17.144Z", "dateReserved": "2024-09-18T19:23:38.003Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2024-10-08T06:00:03.744Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}