PT-2020-10373 · Cththemes · Cththemes Townhub+2

M0Ze + 1 · Published 2020-01-13 · Updated 2020-01-14 · CVE-2019-20211

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CTHthemes CityBook versions prior to 2.3.4 CTHthemes TownHub versions prior to 1.0.6 CTHthemes EasyBook versions prior to 1.2.2

Description The issue allows for Persistent XSS attacks. This can be achieved via various fields such as Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.

Recommendations For CTHthemes CityBook versions prior to 2.3.4, update to version 2.3.4 or later. For CTHthemes TownHub versions prior to 1.0.6, update to version 1.0.6 or later. For CTHthemes EasyBook versions prior to 1.2.2, update to version 1.2.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20211

Affected Products

Cththemes Citybook

Cththemes Easybook

Cththemes Townhub

References · 11

• 🔥 https://cxsecurity.com/issue/WLB-2019120112 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2019120111 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2019120110 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20211 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20211 · Vendor Advisory
• https://themeforest.net/item/townhub-directory-listing-wordpress-theme/25019571 · Note
• https://wpvulndb.com/vulnerabilities/10018 · Note
• https://themeforest.net/item/citybook-directory-listing-wordpress-theme/21694727 · Note
• https://themeforest.net/item/easybook-directory-listing-wordpress-theme/23206622 · Note
• https://wpvulndb.com/vulnerabilities/10014 · Note
• https://wpvulndb.com/vulnerabilities/10013 · Note