CVE-2021-42365

Asgaros Forums <= 1.15.13 - Authenticated Stored Cross-Site Scripting

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

4.8

CVSS Score

4.8

CVSS Score

medium

Severity

1.15.14

Patched in

785d

Time to patch

Description

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=1.15.13

PublishedNovember 29, 2021

Last updatedJanuary 22, 2024

Affected pluginasgaros-forum

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/3d39ae72-7d45-4ca9-9de1-8532ec5e043d?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database