CVE-2021-39337

Description

The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/jobs_function.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

Related CPE's

ajob-portal_projectjob-portal*****wordpress**

References

https://plugins.trac.wordpress.org/browser/job-portal/trunk/admin/jobs_function.php#L99

PatchThird Party Advisory

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39337

Third Party Advisory

https://github.com/BigTiger2020/word-press/blob/main/job-portal.md

ExploitThird Party Advisory

CvssV3 impact

BaseSeverity

MEDIUM

ConfidentialityImpact

LOW

AttackComplexity

LOW

Scope

CHANGED

AttackVector

NETWORK

AvailabilityImpact

NONE

IntegrityImpact

LOW

PrivilegesRequired

HIGH

BaseScore

4.8

VectorString

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Version

3.1

UserInteraction

REQUIRED

CvssV2 impact

AccessComplexity

HIGH

ConfidentialityImpact

NONE

AvailabilityImpact

NONE

IntegrityImpact

PARTIAL

BaseScore

2.1

VectorString

AV:N/AC:H/Au:S/C:N/I:P/A:N

Version

2.0

AccessVector

NETWORK

Authentication

SINGLE

Created by Yello
About Severity.io