2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"product":"miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login","vendor":"Unknown","versions":[{"lessThan":"5.5.6","status":"affected","version":"5.5.6","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:miniorange:google_authenticator:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"A15D2A66-459A-4C88-9B7F-B754603C7448","versionEndExcluding":"5.5.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)"},{"lang":"es","value":"El plugin miniOrange's Google Authenticator de WordPress versiones anteriores a 5.5.6, no sanea ni escapa de algunas de sus configuraciones, lo que conlleva a que usuarios con privilegios de administrador almacenen código Javascript malicioso, lo que conlleva a ataques de tipo Cross-Site Scripting cuando unfiltered_html no está permitido (por ejemplo, en una configuración multisitio)"}],"id":"CVE-2022-1321","lastModified":"2026-06-17T04:22:12.933","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":3.5,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":6.8,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-06-27T09:15:08.927","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/b8784995-0deb-4c83-959f-52b37881e05c"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/b8784995-0deb-4c83-959f-52b37881e05c"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"contact@wpscan.com","type":"Secondary"}]}
|