PT-2021-15772
CVE-2021-24228
·
تاريخ النشر
2021-04-12
·
تاريخ التحديث
2021-04-14
الوصف من
CVSS 3.1
9.6
حرجةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
Patreon WordPress plugin versions prior to 1.7.2
Description:
A Reflected Cross-Site Scripting issue was identified in the Login Form of the Patreon WordPress plugin. The plugin hooks into the WordPress login form, allowing users to authenticate using their Patreon account. However, error logging logic allowed user-controlled input to be reflected on the login page without proper sanitization.
Recommendations:
For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the login form until the update is applied.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾