CVE-2024-9443

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Published: Nov 5, 2024 / Updated: 14d ago

010
CVSS 5.4EPSS 0.05%Medium
CVE info copied to clipboard

Summary

The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions up to and including 1.5.0. This vulnerability is due to insufficient input sanitization and output escaping. It allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Impact

This vulnerability could allow attackers to inject malicious scripts into SVG files, which would then be executed in the context of other users' browsers when they view the affected pages. This can lead to various attacks such as stealing sensitive information (like session cookies or authentication tokens), defacing the website, or redirecting users to malicious sites. The impact is somewhat limited as it requires the attacker to have authenticated access with at least Author-level privileges, and user interaction is required for the exploit to be successful.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in version 1.5.1 of the Basticom Framework plugin for WordPress. Users should update to this version or later to mitigate the risk.

Mitigation

1. Update the Basticom Framework plugin to version 1.5.1 or later immediately. 2. If immediate updating is not possible, consider temporarily disabling SVG file uploads or implementing additional server-side validation and sanitization for SVG files. 3. Limit the number of users with Author-level access or higher to reduce the potential attack surface. 4. Implement Content Security Policy (CSP) headers to help mitigate the impact of successful XSS attacks. 5. Regularly audit and review user roles and permissions to ensure principle of least privilege is maintained. 6. Consider using Web Application Firewalls (WAF) that can help detect and block XSS attempts.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9443. See article

Nov 5, 2024 at 8:49 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 5, 2024 at 8:49 AM
CVE Assignment

NVD published the first details for CVE-2024-9443

Nov 5, 2024 at 9:15 AM
CVSS

A CVSS base score of 6.4 has been assigned.

Nov 5, 2024 at 9:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 22.2%)

Nov 6, 2024 at 10:26 AM
CVSS

A CVSS base score of 5.4 has been assigned.

Nov 7, 2024 at 9:00 PM / nvd
Static CVE Timeline Graph

Affected Systems

Basticom/framework
+null more

Patches

plugins.trac.wordpress.org
+null more

Attack Patterns

CAPEC-209: XSS Using MIME Type Mismatch
+null more

News

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 4, 2024 to November 10, 2024)
WordPress Plugins with Reported Vulnerabilities Last Week Use constructor to create tables profit-products-tables-for-woocommerce Add Ribbon Shortcode add-ribbon Admin Amplify wpr-admin-amplify Advanced Video Player with Analytics advanced-video-player-with-analytics Adventure Bucket List adventure-bucket-list AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress agendapress Ajax Content Filter ajax-content-filter Alert Me!
CVE-2024-9443
Gravedad 3.1 (CVSS 3.1 Base Score) Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Basticom Framework <= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Basticom - MEDIUM - CVE-2024-9443 The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVE-2024-9443 - Basticom Framework WordPress Stored Cross-Site Scripting (XSS)
CVE ID : CVE-2024-9443 Published : Nov. 5, 2024, 9:15 a.m. 49 minutes ago Description : The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Severity: 6.4
CVE-2024-9443
The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG...
See 3 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:Required
Scope:Changed
Confidentiality:Low
Integrity:Low
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI