CVE-2022-0879

MEDIUMNuclei

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0879 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Caldera Forms – More Than Contact Forms

CVE List1.9.7 to < 1.9.7affected

Nuclei templates

1
ProjectDiscoveryMEDIUMCaldera Forms < 1.9.7 - Reflected Cross-Site ScriptingCVSS 6.1

Caldera Forms WordPress plugin < 1.9.7 contains a reflected cross-site scripting caused by lack of validation and escaping of the cf-api parameter in responses, letting attackers execute arbitrary scripts in victim's browser, exploit requires attacker to craft a malicious request.

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.

Remediation

Update to version 1.9.7 or later.

WeaknessesCWE-79
Authors0x_Akoko
Template tagswpscancvecve2022wordpressxsscaldera-formsreflectedunauth
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:calderaforms:caldera_forms:*:*:*:*:*:wordpress:*:*
https://nvd.nist.gov/vuln/detail/CVE-2022-0879 https://wpscan.com/vulnerability/10e8e92a-4e1d-4e9c-8b3e-e8c5e0e0e0e0 https://github.com/20142995/nuclei-templates

Source: ProjectDiscovery

References

2