CVE-2022-0381

MEDIUMNuclei

Embed Swagger <= 1.0.0 Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0381 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 10, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Embed Swagger

Browse Embed Swagger / Embed Swagger
CVE List1.0.0 to ≤ 1.0.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Embed Swagger <=1.0.0 - Cross-Site ScriptingCVSS 6.1

WordPress Embed Swagger plugin 1.0.0 and prior contains a reflected cross-site scripting vulnerability due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file, which allows attackers to inject arbitrary web scripts onto the page.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress Embed Swagger plugin (1.0.0) or apply a patch provided by the vendor.

WeaknessesCWE-79
Authorsedoardottt
Template tagscvecve2022swaggerxsswordpressembed_swagger_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:embed_swagger_project:embed_swagger:*:*:*:*:*:wordpress:*:*
https://gist.github.com/Xib3rR4dAr/4b3ea7960914e23c3a875b973a5b37a3 https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0381 https://nvd.nist.gov/vuln/detail/CVE-2022-0381 https://plugins.trac.wordpress.org/browser/embed-swagger/trunk/swagger-iframe.php#L59 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4