PT-2022-13141 · WordPress · Embed Swagger

Muhammad Zeeshan · Published 2022-02-04 · Updated 2022-02-10 · CVE-2022-0381

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Embed Swagger WordPress plugin version 1.0.0 and earlier

Description The issue arises from insufficient escaping, sanitization, and validation of the url parameter in the ~/swagger-iframe.php file, allowing attackers to inject arbitrary web scripts onto the page via Reflected Cross-Site Scripting.

Recommendations For Embed Swagger WordPress plugin version 1.0.0 and earlier, update to a version that addresses the insufficient escaping and sanitization of the url parameter to prevent Reflected Cross-Site Scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0381

Affected Products

Embed Swagger

References · 5

• 🔥 https://gist.github.com/Xib3rR4dAr/4b3ea7960914e23c3a875b973a5b37a3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0381 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0381 · Vendor Advisory
• https://wordfence.com/vulnerability-advisories/#CVE-2022-0381 · Note
• https://plugins.trac.wordpress.org/browser/embed-swagger/trunk/swagger-iframe.php#L59 · Note