CVE-2021-24455

{"id": "CVE-2021-24455", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-08-02T11:15:09.300", "references": [{"url": "https://wpscan.com/vulnerability/9ef14cf1-1e04-4125-a296-9aa5388612f9", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/9ef14cf1-1e04-4125-a296-9aa5388612f9", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Tutor LMS \u2013 eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin."}, {"lang": "es", "value": "El plugin de WordPress Tutor LMS - eLearning and online course solution versiones anteriores a 1.9.2, no escapaba el campo Summary of Announcements (cuando lo mostraba en un atributo), que puede ser creado por usuarios tan bajos como Tutor Instructor. Esto conllevaba a un problema de tipo Cross-Site Scripting Almacenado, que se desencadena cuando se visualiza la lista de Anuncios, y pod\u00eda resultar en una escalada de privilegios cuando era visualizada por un administrador"}], "lastModified": "2024-11-21T05:53:06.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:themeum:tutor_lms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "212A8F9E-E649-42E9-955C-73F4E3EF4A61", "versionEndExcluding": "1.9.2"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}