CVE-2024-8056

The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/203b8122-f1e5-4e9e-ba83-f5cd59d8a289/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mm-breaking_news_project:mm-breaking_news:*:*:*:*:*:wordpress:*:*

History

27 Sep 2024, 21:29

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mm-breaking_news_project:mm-breaking_news::::::wordpress::*
First Time		Mm-breaking News Project mm-breaking News Mm-breaking News Project
References	~~() https://wpscan.com/vulnerability/203b8122-f1e5-4e9e-ba83-f5cd59d8a289/ -~~	() https://wpscan.com/vulnerability/203b8122-f1e5-4e9e-ba83-f5cd59d8a289/ - Exploit, Third Party Advisory
CWE		CWE-79

12 Sep 2024, 13:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1

12 Sep 2024, 12:35

Type	Values Removed	Values Added
Summary		(es) El complemento MM-Breaking News de WordPress hasta la versión 0.7.9 no escapa al parámetro $_SERVER['REQUEST_URI'] antes de mostrarlo nuevamente en un atributo, lo que podría generar cross site scripting reflejado en navegadores web antiguos.

12 Sep 2024, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-12 06:15

Updated : 2024-09-27 21:29

NVD link : CVE-2024-8056

Mitre link : CVE-2024-8056

CVE.ORG link : CVE-2024-8056

JSON object : View

Products Affected

mm-breaking_news_project

mm-breaking_news

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.1 /10