CVE-2021-24435

MEDIUMNuclei

Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24435 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Titan Framework

CVE List1.12.1 to ≤ 1.12.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Titan Framework plugin <= 1.12.1 - Cross-Site ScriptingCVSS 6.1

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Fixed in version 2.7.12

WeaknessesCWE-79
Authorsxcapri, ritikchaddha
Template tagscve2021cvewpxsswp-plugintitan-frameworkwpscanwordpressgambitvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:gambit:titan_framework:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/a88ffc42-6611-406e-8660-3af24c9cc5e8 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24435 https://nvd.nist.gov/vuln/detail/CVE-2021-24435 https://patchstack.com/database/vulnerability/titan-framework/wordpress-titan-framework-plugin-1-12-1-reflected-cross-site-scripting-xss-vulnerability https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2