One Article Review
| Source |  CVE Liste |
|---|---|
| Identifiant | 3628930 |
| Date de publication | 2021-11-08 18:15:09 (vue: 2021-11-08 20:05:55) |
| Titre | CVE-2021-24693 |
| Texte | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin |
| Envoyé | Oui |
| Condensat | 2021 24693 account admin allow attacks before code context contributor could create cross cve does download escape even execute file given install javascript low make malicious meta monitor not outputting pages perform plugin post review reviewer rogue role scripting simple site some state stored such them thumbnail triggered users when which wordpress xss |
| Tags | |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.