CVE-2024-10146

MEDIUMNuclei

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-10146 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 14, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Simple File List

Default status: unaffected

CVE ListBefore 6.1.13affected

simple_file_list

Browse simplefilelist / simple_file_list

Default status: unknown

CVE ListBefore 6.1.13affected

Nuclei templates

1
ProjectDiscoveryMEDIUMSimple File List < 6.1.13 - Reflected Cross-Site ScriptingCVSS 5.4

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin.

Impact

Attackers can execute malicious scripts in admin browsers, potentially leading to session hijacking or privilege escalation.

Remediation

Update to version 6.1.13 or later.

WeaknessesCWE-79
Authors0x_AKoko
Template tagscvecve2024wpscanwordpresswp-pluginwpsimple-file-listxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:simplefilelist:simple_file_list:*:*:*:*:*:wordpress:*:*
FOFA: wp-content/plugins/simple-file-list/
Google: inurl:"/wp-content/plugins/simple-file-list/"
https://wpscan.com/vulnerability/9ee74a0f-83ff-4c15-a114-f8f6baab8bf5/ https://nvd.nist.gov/vuln/detail/CVE-2024-10146

Source: ProjectDiscovery

References

2