PT-2021-16201
CVE-2021-24697
·
تاريخ النشر
2021-11-08
·
تاريخ التحديث
2021-11-11
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Simple Download Monitor WordPress plugin versions prior to 3.9.5
Description
The issue arises from the failure to escape certain parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. The parameters in question are the
sdm active tab GET parameter and the sdm stats start date and sdm stats end date POST parameters.Recommendations
For versions prior to 3.9.5, update to version 3.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters
sdm active tab, sdm stats start date, and sdm stats end date to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾