PT-2022-14859 · WordPress · Download Manager

Andrea Bocchetti · Published 2022-07-18 · Updated 2024-01-11 · CVE-2022-2101

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.46

Description The issue is related to Stored Cross-Site Scripting via the file[files][] parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page, which will execute whenever an administrator accesses the editor area for the injected file page.

Recommendations For versions up to, and including, 3.2.46, update to a version higher than 3.2.46 to resolve the issue. As a temporary workaround, consider restricting access to the file[files][] parameter to minimize the risk of exploitation. Additionally, limiting contributor level permissions may also help mitigate the risk until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-2101

Affected Products

Download Manager

References · 10

• 🔥 https://medium.com/%40andreabocchetti88/download-manager-3-2-43-contributor-cross-site-scripting-fa4970fba45c · Exploit
• 🔥 https://packetstormsecurity.com/files/167573 · Exploit
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2750339%40download-manager&new=2750339%40download-manager&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2101 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2101 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/b399929a-db33-419f-9218-b86ee88a9f1a?source=cve · Note
• https://t.me/cvenotify/33738 · Telegram Post
• https://wordfence.com/vulnerability-advisories/#CVE-2022-2101 · Note
• https://t.me/cvenotify/67028 · Telegram Post
• https://t.me/cibsecurity/46476 · Telegram Post