CVE-2024-7132

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/16deb743-6fe9-43a2-9586-d92cfe1daa17/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:godaddy:coblocks:*:*:*:*:*:wordpress:*:*

History

07 Oct 2024, 15:44

Type	Values Removed	Values Added
First Time		Godaddy Godaddy coblocks
Summary		(es) El complemento Page Builder Gutenberg Blocks de WordPress anterior a la versión 3.1.13 no escapa del contenido de las publicaciones incrustadas a través de uno de sus bloques, lo que podría permitir a los usuarios con la capacidad de publicar publicaciones (editor y administrador de forma predeterminada) realizar ataques de Cross-Site Scripting Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio)
CWE		CWE-79
References	~~() https://wpscan.com/vulnerability/16deb743-6fe9-43a2-9586-d92cfe1daa17/ -~~	() https://wpscan.com/vulnerability/16deb743-6fe9-43a2-9586-d92cfe1daa17/ - Exploit, Third Party Advisory
CPE		cpe:2.3:a:godaddy:coblocks::::::wordpress::*

29 Aug 2024, 20:37

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.8

29 Aug 2024, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-29 11:15

Updated : 2024-10-07 15:44

NVD link : CVE-2024-7132

Mitre link : CVE-2024-7132

CVE.ORG link : CVE-2024-7132

JSON object : View

Products Affected

godaddy

coblocks

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-7132", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-08-29T11:15:28.463", "references": [{"url": "https://wpscan.com/vulnerability/16deb743-6fe9-43a2-9586-d92cfe1daa17/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)"}, {"lang": "es", "value": "El complemento Page Builder Gutenberg Blocks de WordPress anterior a la versi\u00f3n 3.1.13 no escapa del contenido de las publicaciones incrustadas a trav\u00e9s de uno de sus bloques, lo que podr\u00eda permitir a los usuarios con la capacidad de publicar publicaciones (editor y administrador de forma predeterminada) realizar ataques de Cross-Site Scripting Almacenado incluso cuando la capacidad unfiltered_html no est\u00e1 permitida (por ejemplo, en una configuraci\u00f3n multisitio)"}], "lastModified": "2024-10-07T15:44:37.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:godaddy:coblocks:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "70F564FC-8889-4F1E-87B1-3E013DBD885D", "versionEndExcluding": "3.1.13"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}