PT-2021-15919 · WordPress · Wp Svg Images

Afeef + 1 · Published 2021-07-06 · Updated 2021-07-09 · CVE-2021-24386

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP SVG images WordPress plugin versions prior to 3.4

Description The issue allows low privilege users, such as author+, to upload malicious SVG files, which could lead to XSS attacks by inducing another user to access the file directly. The plugin has been updated to restrict such uploads to editors and admin, with an option to also allow authors to upload. A security warning has been added to the plugin description.

Recommendations For versions prior to 3.4, update to version 3.4 or later, which restricts the upload of SVG files to editors and admin, and includes an option to allow authors to upload. As a temporary workaround, consider restricting the upload of SVG files to trusted users until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24386

Affected Products

Wp Svg Images

References · 5

• 🔥 https://wpscan.com/vulnerability/e9b48b19-14cc-41ad-a029-f7f9ae236e4e · Exploit
• https://osv.dev/vulnerability/CVE-2021-24386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24386 · Security Note
• https://t.me/cvenotify/17116 · Telegram Post
• https://t.me/cibsecurity/25922 · Telegram Post