PT-2022-7145 · WordPress · Spidercalendar

Krzysztof Zając · Published 2022-01-13 · Updated 2022-02-19 · CVE-2022-0212

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SpiderCalendar WordPress plugin versions 1.5.65 and earlier

Description The issue exists due to insufficient protection of the webpage structure, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. Specifically, the SpiderCalendar WordPress plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, which is available to both unauthenticated and authenticated users. This leads to a Reflected Cross-Site Scripting issue.

Recommendations For SpiderCalendar WordPress plugin versions 1.5.65 and earlier, consider disabling the window AJAX action until a patch is available. Restrict access to the callback parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07858

CVE-2022-0212

Affected Products

Spidercalendar

References · 5

• 🔥 https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0212 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07858 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0212 · Security Note
• https://t.me/cibsecurity/37388 · Telegram Post