CVE-2021-24277 (GCVE-0-2021-24277)

Vulnerability from cvelistv5 – Published: 2021-05-14 11:38 – Updated: 2024-08-03 19:28
VLAI
Title
RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)
Summary
The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Assigner
References
Impacted products
Vendor Product Version
Flector RSS for Yandex Turbo Affected: 1.30 , < 1.30 (custom)
Create a notification for this product.
Credits
Himamshu Dilip Kulkarni
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:28:22.658Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RSS for Yandex Turbo",
          "vendor": "Flector",
          "versions": [
            {
              "lessThan": "1.30",
              "status": "affected",
              "version": "1.30",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Himamshu Dilip Kulkarni"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its \u0421\u0447\u0435\u0442\u0447\u0438\u043a\u0438 settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-14T11:38:16.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RSS for Yandex Turbo \u003c 1.30 - Authenticated Stored Cross-Site Scripting (XSS)",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24277",
          "STATE": "PUBLIC",
          "TITLE": "RSS for Yandex Turbo \u003c 1.30 - Authenticated Stored Cross-Site Scripting (XSS)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "RSS for Yandex Turbo",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.30",
                            "version_value": "1.30"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Flector"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Himamshu Dilip Kulkarni"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its \u0421\u0447\u0435\u0442\u0447\u0438\u043a\u0438 settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4",
              "refsource": "CONFIRM",
              "url": "https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24277",
    "datePublished": "2021-05-14T11:38:16.000Z",
    "dateReserved": "2021-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:28:22.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-24277",
      "date": "2026-06-03",
      "epss": "0.00332",
      "percentile": "0.56302"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-24277\",\"sourceIdentifier\":\"contact@wpscan.com\",\"published\":\"2021-05-14T12:15:08.160\",\"lastModified\":\"2024-11-21T05:52:44.633\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its \u0421\u0447\u0435\u0442\u0447\u0438\u043a\u0438 settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues\"},{\"lang\":\"es\",\"value\":\"El plugin de WordPress RSS for Yandex Turbo versiones anteriores a 1.30 no sanean apropiadamente las entradas del usuario desde su pesta\u00f1a de configuraci\u00f3n \u00d0\u00a1\u00d1\u2021\u00d0\u00b5\u00d1\u201a\u00d1\u2021\u00d0\u00b8\u00d0\u00ba\u00d0\u00b8 antes de devolverlas a la p\u00e1gina, lo que conlleva a problemas de tipo cross-site scripting almacenado y no autenticado\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"contact@wpscan.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wpuslugi:rss_for_yandex_turbo:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.30\",\"matchCriteriaId\":\"5AB710E4-11CA-4605-A6C1-C48F4DD95DC2\"}]}]}],\"references\":[{\"url\":\"https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4\",\"source\":\"contact@wpscan.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.