github - ghsa-8pm6-f5wq-7x35

ghsa-8pm6-f5wq-7x35

Vulnerability from github

Published

2022-02-15 00:02

Modified

2022-02-20 00:00

Details

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-0201"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-14T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue",
  "id": "GHSA-8pm6-f5wq-7x35",
  "modified": "2022-02-20T00:00:43Z",
  "published": "2022-02-15T00:02:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0201"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2656512"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2022-0201

Vulnerability from cvelistv5

Published

2022-02-14 09:21

Modified

2024-08-02 23:18

Severity ?

Summary

Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting

References

▼	URL	Tags
	https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4	x_refsource_MISC
	https://plugins.trac.wordpress.org/changeset/2656512	x_refsource_CONFIRM

Impacted products

▼	Vendor	Product
	Maciej Bis	Permalink Manager Lite
	Maciej Bis	Permalink Manager Pro

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:18:42.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/2656512"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Permalink Manager Lite",
          "vendor": "Maciej Bis",
          "versions": [
            {
              "lessThan": "2.2.15",
              "status": "affected",
              "version": "2.2.15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Permalink Manager Pro",
          "vendor": "Maciej Bis",
          "versions": [
            {
              "lessThan": "2.2.15",
              "status": "affected",
              "version": "2.2.15",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Krzysztof Zaj\u0105c"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-14T09:21:04",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/2656512"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Permalink Manager \u003c 2.2.15 - Reflected Cross-Site Scripting",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-0201",
          "STATE": "PUBLIC",
          "TITLE": "Permalink Manager \u003c 2.2.15 - Reflected Cross-Site Scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Permalink Manager Lite",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.2.15",
                            "version_value": "2.2.15"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Permalink Manager Pro",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.2.15",
                            "version_value": "2.2.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Maciej Bis"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Krzysztof Zaj\u0105c"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4"
            },
            {
              "name": "https://plugins.trac.wordpress.org/changeset/2656512",
              "refsource": "CONFIRM",
              "url": "https://plugins.trac.wordpress.org/changeset/2656512"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-0201",
    "datePublished": "2022-02-14T09:21:04",
    "dateReserved": "2022-01-12T00:00:00",
    "dateUpdated": "2024-08-02T23:18:42.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.