CVE-2021-24364

MEDIUMNuclei

Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24364 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Jannah

Browse TieLabs / Jannah
CVE List5.4.4 to < 5.4.4affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Jannah Theme <5.4.4 - Cross-Site ScriptingCVSS 6.1

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Update the WordPress Jannah Theme to version 5.4.4 or later, which includes a fix for this vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscve2021cvewordpressxsswp-themewpscantielabsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:tielabs:jannah:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-768a80018382 https://nvd.nist.gov/vuln/detail/CVE-2021-24364 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon https://github.com/crpytoscooby/resourses_web

Source: ProjectDiscovery

References

2