PT-2021-23427 · WordPress · Fathom Analytics

José Aguilera · Published 2021-12-14 · Updated 2021-12-17 · CVE-2021-41836

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fathom Analytics WordPress plugin versions up to and including 3.0.4

Description The issue arises from insufficient input validation and escaping via the site id parameter in the ~/fathom-analytics.php file, allowing attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations where unfiltered html is disabled for administrators, and sites where unfiltered html is disabled.

Recommendations For versions up to and including 3.0.4, update to a version that includes the necessary input validation and escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the ~/fathom-analytics.php file or disabling the site id parameter until a patch is available. Additionally, review and adjust the unfiltered html settings for administrators to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41836

Affected Products

Fathom Analytics

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-41836 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2641005%40fathom-analytics&new=2641005%40fathom-analytics&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2021-41836 · Vendor Advisory
• https://wordfence.com/vulnerability-advisories/#CVE-2021-41836 · Note