ID
VAR-202205-0286
CVE
CVE-2021-25102
TITLE
All In One WP Security & Firewall WordPress Cross-site scripting vulnerability in plugins
Trust: 0.8
DESCRIPTION
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk. All In One WP Security & Firewall WordPress A cross-site scripting vulnerability exists in the plugin.Information may be obtained and information may be tampered with. Both WordPress and WordPress plugins are products of the WordPress Foundation. WordPress is a blogging platform developed using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. A WordPress plugin is an application plugin. The redirect_to parameter is defined, an attacker can exploit this vulnerability to execute JavaScript code on the client
Trust: 1.8
AFFECTED PRODUCTS
| vendor: | tipsandtricks hq | model: | all in one wp security \& firewall | scope: | lt | version: | 4.4.11 | Trust: 1.0 |
| vendor: | tips and tricks hq | model: | all in one wp security & firewall | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tips and tricks hq | model: | all in one wp security & firewall | scope: | eq | version: | 4.4.11 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-79 | Trust: 1.1 |
| problemtype: | Cross-site scripting (CWE-79) [ others ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
XSS
Trust: 0.6
PATCH
| title: | All-In-One Security (AIOS) - Security and Firewall | url: | https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ | Trust: 0.8 |
| title: | WordPress plugin All In One WP Security & Firewall Fixes for cross-site scripting vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=191234 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-25102 | Trust: 3.4 |
| db: | JVNDB | id: | JVNDB-2022-010251 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202205-1900 | Trust: 0.6 |
| db: | CNVD | id: | CNVD-2022-59805 | Trust: 0.1 |
| db: | VULHUB | id: | VHN-383823 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2021-25102 | Trust: 0.1 |
REFERENCES
| url: | https://wpscan.com/vulnerability/9b8a00a6-622b-4309-bbbf-fe2c7fc9f8b6 | Trust: 2.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-25102 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2021-25102/ | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/79.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-383823 |
| db: | VULMON | id: | CVE-2021-25102 |
| db: | JVNDB | id: | JVNDB-2022-010251 |
| db: | CNNVD | id: | CNNVD-202205-1900 |
| db: | NVD | id: | CVE-2021-25102 |
LAST UPDATE DATE
2024-08-14T15:42:25.989000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-383823 | date: | 2022-05-10T00:00:00 |
| db: | VULMON | id: | CVE-2021-25102 | date: | 2022-05-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-010251 | date: | 2023-08-14T06:05:00 |
| db: | CNNVD | id: | CNNVD-202205-1900 | date: | 2022-05-11T00:00:00 |
| db: | NVD | id: | CVE-2021-25102 | date: | 2022-05-10T13:14:58.547 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-383823 | date: | 2022-05-02T00:00:00 |
| db: | VULMON | id: | CVE-2021-25102 | date: | 2022-05-02T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-010251 | date: | 2023-08-14T00:00:00 |
| db: | CNNVD | id: | CNNVD-202205-1900 | date: | 2022-05-02T00:00:00 |
| db: | NVD | id: | CVE-2021-25102 | date: | 2022-05-02T16:15:08.093 |