CVE-2022-0212

{"id": "CVE-2022-0212", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-02-14T12:15:16.550", "references": [{"url": "https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue."}, {"lang": "es", "value": "El plugin SpiderCalendar para WordPress versiones hasta 1.5.65, no sanea y escapa del par\u00e1metro callback antes de devolverlo a la p\u00e1gina por medio de la acci\u00f3n AJAX de la ventana (disponible tanto para usuarios no autenticados como autenticados), conllevando a un problema de tipo Cross-Site Scripting Reflejado"}], "lastModified": "2024-11-21T06:38:09.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:10web:spidercalendar:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "CE3CDC82-5C83-472C-998A-2E35EFD522A2", "versionEndIncluding": "1.5.65"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}