CVE-2021-42365

· MEDIUMModified

← All CVEs

CVSS v3.1

4.8

EPSS

0.68%

Published

Nov 29, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79CWE-79

Affected Products (1)

asgaros · asgaros_forum (up to 1.15.14)vulnerable

References (4)

https://plugins.trac.wordpress.org/changeset/2635143/asgaros-forum/trunk/admin/tables/admin-structure-table.php

PatchThird Party Advisory

https://wordfence.com/vulnerability-advisories/#CVE-2021-42365

Third Party Advisory

https://plugins.trac.wordpress.org/changeset/2635143/asgaros-forum/trunk/admin/tables/admin-structure-table.php

PatchThird Party Advisory

https://wordfence.com/vulnerability-advisories/#CVE-2021-42365

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs