PT-2021-4128 · WordPress · Simple Behance Portfolio

P7E4 · Published 2021-08-16 · Updated 2021-08-23 · CVE-2021-34649

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Behance Portfolio WordPress plugin versions up to and including 0.2

Description The issue allows attackers to inject arbitrary web scripts via the dark parameter in the ~/titan-framework/iframe-font-preview.php file. This is a Reflected Cross-Site Scripting vulnerability.

Recommendations For versions up to and including 0.2, consider disabling access to the ~/titan-framework/iframe-font-preview.php file or restricting the use of the dark parameter until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04720

CVE-2021-34649

Affected Products

Simple Behance Portfolio

References · 8

• 🔥 https://wordfence.com/vulnerability-advisories/#CVE-2021-34649 · Exploit
• 🔥 https://plugins.trac.wordpress.org/browser/simple-behace-portfolio/trunk/titan-framework/iframe-font-preview.php#L141 · Exploit
• https://osv.dev/vulnerability/CVE-2021-34649 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04720 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34649 · Security Note
• https://t.me/cibsecurity/27392 · Telegram Post
• https://t.me/cvenotify/19461 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021082009 · Note