CVE-2022-0599

MEDIUMNuclei

Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0599 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Mapping multiple URLs redirect same page

CVE List5.8 to ≤ 5.8affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site ScriptingCVSS 6.1

WordPress Mapping Multiple URLs Redirect Same Page plugin 5.8 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress Mapping Multiple URLs Redirect Same Page plugin (version 5.8 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
Authorsscent2d
Template tagscvecve2022wordpresswp-pluginxsswpauthenticatedwpscanmapping_multiple_urls_redirect_same_page_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:mapping_multiple_urls_redirect_same_page_project:mapping_multiple_urls_redirect_same_page:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/4f1d45bc-d3bd-472c-959d-05abeff32765 https://wordpress.org/plugins/mapping-multiple-urls-redirect-same-page/ https://nvd.nist.gov/vuln/detail/cve-2022-0599 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2