CVE-2023-1893

MEDIUMNuclei

Login Configurator <= 2.1 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-1893 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 5, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Login Configurator

Default status: affected

CVE ListThrough 2.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMLogin Configurator <=2.1 - Cross-Site ScriptingCVSS 6.1

Login Configurator WordPress plugin <= 2.1 contains a reflected cross-site scripting caused by improper escaping of URL parameter before outputting it to the page, letting attackers execute scripts in the context of site administrators, exploit requires victim to visit a malicious URL.

Impact

Attackers can execute arbitrary scripts in the context of site administrators, potentially leading to session hijacking or account compromise.

Remediation

Update to the latest version of the plugin where the issue is fixed.

WeaknessesCWE-79
Authors0xr2r
Template tagscvecve2023wpwp-pluginwordpressxsslogin_configuratorvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:login_configurator_project:login_configurator:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/dbe6cf09-971f-42e9-b744-9339454168c7 http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.html https://nvd.nist.gov/vuln/detail/CVE-2023-1893

Source: ProjectDiscovery

References

3