PT-2021-11808
CVE-2020-35581
·
تاريخ النشر
2021-01-13
·
تاريخ التحديث
2021-01-15
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
Envira Gallery Lite versions prior to 1.8.3.3
Description:
A stored cross-site scripting (XSS) issue allows remote attackers to inject arbitrary JavaScript/HTML code via a POST "/wp-admin/admin-ajax.php" request with the
meta[title] parameter.Recommendations:
For Envira Gallery Lite versions prior to 1.8.3.3, update to version 1.8.3.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the "/wp-admin/admin-ajax.php" endpoint to minimize the risk of exploitation.
Avoid using the
meta[title] parameter in the affected API endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾