CVE-2021-24214

MEDIUMNuclei

OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24214 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

OpenID Connect Generic Client

Browse daggerhart / OpenID Connect Generic Client
CVE List3.8.0 to < 3.8.0*affected
3.8.2 to < 3.8.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site ScriptingCVSS 6.1

WordPress OpenID Connect Generic Client plugin 3.8.0 and 3.8.1 contains a cross-site scripting vulnerability. It does not sanitize the login error when output back in the login form, thereby not requiring authentication, which can be exploited with the default configuration.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress OpenID Connect Generic Client plugin (3.8.2) to fix this vulnerability.

WeaknessesCWE-79
Authorstess
Template tagscve2021cvewpscanwordpressxsswp-pluginwpopeniddaggerhartlabvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:daggerhartlab:openid_connect_generic_client:3.8.0:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/31cf0dfb-4025-4898-a5f4-fc7115565a10 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24214 https://nvd.nist.gov/vuln/detail/CVE-2021-24214 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2