CVE-2024-6018

The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/c3f50e30-c7c5-4e7e-988c-ab884d75870b/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:scriptonite:music_request_manager:*:*:*:*:*:wordpress:*:*

History

13 Sep 2024, 16:15

Type	Values Removed	Values Added
CWE		CWE-79
References	~~() https://wpscan.com/vulnerability/c3f50e30-c7c5-4e7e-988c-ab884d75870b/ -~~	() https://wpscan.com/vulnerability/c3f50e30-c7c5-4e7e-988c-ab884d75870b/ - Exploit, Third Party Advisory
CPE		cpe:2.3:a:scriptonite:music_request_manager::::::wordpress::*
First Time		Scriptonite Scriptonite music Request Manager

12 Sep 2024, 19:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1

12 Sep 2024, 12:35

Type	Values Removed	Values Added
Summary		(es) El complemento Music Request Manager de WordPress hasta la versión 1.3 no escapa al parámetro $_SERVER['REQUEST_URI'] antes de mostrarlo nuevamente en un atributo, lo que podría generar cross site scripting reflejado en navegadores web antiguos.

12 Sep 2024, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-12 06:15

Updated : 2024-09-13 16:15

NVD link : CVE-2024-6018

Mitre link : CVE-2024-6018

CVE.ORG link : CVE-2024-6018

JSON object : View

Products Affected

scriptonite

music_request_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.1 /10