CVE-2022-2599

MEDIUMNuclei

Anti-Malware Security and Brute-Force Firewall < 4.21.83 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-2599 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Anti-Malware Security and Brute-Force Firewall

CVE List4.21.83 to < 4.21.83affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site ScriptingCVSS 6.1

WordPress Anti-Malware Security and Brute-Force Firewall plugin before 4.21.83 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in an admin dashboard.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the targeted WordPress site, potentially leading to unauthorized access, data theft, or further attacks.

Remediation

Update the WordPress Anti-Malware Security and Brute-Force Firewall plugin to version 4.21.83 or later to mitigate the vulnerability.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2022wordpresswp-pluginxssgotmlsauthenticatedwpscananti-malware_security_and_brute-force_firewall_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:anti-malware_security_and_brute-force_firewall_project:anti-malware_security_and_brute-force_firewall:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/276a7fc5-3d0d-446d-92cf-20060aecd0ef https://wordpress.org/plugins/gotmls/advanced/ https://nvd.nist.gov/vuln/detail/CVE-2022-2599 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2