CVE-2019-16332

MEDIUMNuclei

WordPress API Bearer Auth <20190907 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-16332 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.

Description

In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2
Nuclei templates
1

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2019-16332Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 315 B

GitHub
PoC details
GitHubCVE-2019-16332Curated repository PoCby yubsy112Not analyzed1 file

Python · 315 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress API Bearer Auth <20190907 - Cross-Site ScriptingCVSS 6.1

WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting vulnerability. The server parameter is not correctly filtered in swagger-config.yaml.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.

Remediation

Update to the latest version of WordPress API Bearer Auth plugin (20190907 or later) to mitigate the vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscvecve2019packetstormwordpressxsswp-pluginauthapi_bearer_auth_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:api_bearer_auth_project:api_bearer_auth:*:*:*:*:*:wordpress:*:*
https://plugins.trac.wordpress.org/changeset/2152730 https://wordpress.org/plugins/api-bearer-auth/#developers https://nvd.nist.gov/vuln/detail/CVE-2019-16332 https://packetstormsecurity.com/files/154369/WordPress-API-Bearer-Auth-20181229-Cross-Site-Scripting.html https://wpvulndb.com/vulnerabilities/9868

Source: ProjectDiscovery

References

5