PT-2021-4509 · Unknown · Kjm Admin Notices

Published 2021-10-14 · Updated 2021-10-20 · CVE-2021-39344

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KJM Admin Notices versions up to and including 2.0.1

Description The issue is related to insufficient input validation and sanitization via several parameters found in the ~/admin/class-kjm-admin-notices-admin.php file, allowing attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations where unfiltered html is disabled for administrators, and sites where unfiltered html is disabled.

Recommendations For versions up to and including 2.0.1, consider disabling the ~/admin/class-kjm-admin-notices-admin.php file or restricting access to it until a patch is available. Additionally, enabling unfiltered html for administrators may help mitigate the risk, but this should be done with caution and careful consideration of the potential security implications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-05147

CVE-2021-39344

Affected Products

Kjm Admin Notices

References · 9

• 🔥 https://github.com/BigTiger2020/word-press/blob/main/KJM%20Admin%20Notices.md · Exploit
• https://bdu.fstec.ru/vul/2021-05147 · Security Note
• https://plugins.trac.wordpress.org/browser/kjm-admin-notices/trunk/admin/class-kjm-admin-notices-admin.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39344 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39344 · Vendor Advisory
• https://t.me/cibsecurity/30612 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021102507 · Note
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39344 · Note
• https://wordpress.org/plugins/kjm-admin-notices · Note