CVE-2021-24349

 

Published at: - 14-06-2021 04:15

Last modified: - 01-08-2022 03:15

Total changes: - 5

Description

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://wpscan.com/vulnerability/6bb4eb71-d702-4732-b01f-b723077d66ca

 

Keywords

NVD

 

CVE-2021-24349

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures