CVE-2021-24559 - OpenCVE

The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Patrickposner	Qyrr

Configuration 1 [-]

cpe:2.3:a:patrickposner:qyrr:*:*:*:*:*:wordpress:*:*

References

Link	Resource
https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: WPScan

Published: 2024-01-16T15:48:44.511Z

Updated: 2024-01-16T15:48:44.511Z

Reserved: 2021-01-14T15:03:46.768Z

Link: CVE-2021-24559

JSON object: View

NVD Information

Status : Analyzed

Published: 2024-01-16T16:15:08.953

Modified: 2024-01-23T17:32:47.457

Link: CVE-2021-24559

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:patrickposner:qyrr:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "0E9662FA-348D-4E17-AE36-5E34C8B218C9", "versionEndExcluding": "0.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue."}, {"lang": "es", "value": "El complemento Qyrr WordPress anterior a 0.7 no escapa del uri de datos del c\u00f3digo QR cuando lo genera en un atributo src, lo que permite ataques de cross site scripting. Adem\u00e1s, la acci\u00f3n data_uri_to_meta AJAX, disponible para todos los usuarios autenticados, solo ten\u00eda una verificaci\u00f3n CSRF implementada, y el nonce disponible para usuarios con un rol tan bajo como Colaborador permite que cualquier usuario con dicho rol (y superior) establezca un dato malicioso. uri en publicaciones de c\u00f3digos QR arbitrarios, lo que genera un problema de cross site scripting almacenado."}], "id": "CVE-2021-24559", "lastModified": "2024-01-23T17:32:47.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-16T16:15:08.953", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}