{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29833", "assignerOrgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae", "state": "PUBLISHED", "assignerShortName": "AppCheck", "dateReserved": "2024-03-20T09:56:32.456Z", "datePublished": "2024-03-26T15:30:28.269Z", "dateUpdated": "2024-08-02T16:46:09.578Z"}, "containers": {"cna": {"title": "WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler", "descriptions": [{"lang": "en", "value": "The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users."}], "affected": [{"vendor": "10Web", "product": "PhotoGallery", "defaultStatus": "unaffected", "versions": [{"version": "1.0.1", "status": "affected", "lessThanOrEqual": "1.8.21", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "value": "AppCheck Ltd.", "type": "finder"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63: Cross-Site Scripting (XSS)"}]}], "references": [{"url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"}, {"url": "https://wordpress.org/plugins/photo-gallery/#developers"}], "providerMetadata": {"orgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae", "shortName": "AppCheck", "dateUpdated": "2024-03-26T15:30:28.269Z"}, "x_generator": {"engine": "cveClient/1.0.15"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:57.411Z"}, "title": "CVE Program Container", "references": [{"url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/", "tags": ["x_transferred"]}, {"url": "https://wordpress.org/plugins/photo-gallery/#developers", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "affected": [{"vendor": "10web", "product": "photo_gallery", "cpes": ["cpe:2.3:a:10web:photo_gallery:1.0.1:*:*:*:*:wordpress:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.0.1", "status": "affected", "lessThanOrEqual": "1.8.21", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T16:46:02.579848Z", "id": "CVE-2024-29833", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T16:46:09.578Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/", "tags": ["x_transferred"]}, {"url": "https://wordpress.org/plugins/photo-gallery/#developers", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:57.411Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29833", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T16:46:02.579848Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:10web:photo_gallery:1.0.1:*:*:*:*:wordpress:*:*"], "vendor": "10web", "product": "photo_gallery", "versions": [{"status": "affected", "version": "1.0.1", "versionType": "semver", "lessThanOrEqual": "1.8.21"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T16:45:59.944Z"}}], "cna": {"title": "WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler", "credits": [{"lang": "en", "type": "finder", "value": "AppCheck Ltd."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63: Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "10Web", "product": "PhotoGallery", "versions": [{"status": "affected", "version": "1.0.1", "versionType": "semver", "lessThanOrEqual": "1.8.21"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"}, {"url": "https://wordpress.org/plugins/photo-gallery/#developers"}], "x_generator": {"engine": "cveClient/1.0.15"}, "descriptions": [{"lang": "en", "value": "The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae", "shortName": "AppCheck", "dateUpdated": "2024-03-26T15:30:28.269Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29833", "state": "PUBLISHED", "dateUpdated": "2024-08-02T16:46:09.578Z", "dateReserved": "2024-03-20T09:56:32.456Z", "assignerOrgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae", "datePublished": "2024-03-26T15:30:28.269Z", "assignerShortName": "AppCheck"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "58CE3C46-F773-4577-8A00-83AB7A8442C6", "versionEndExcluding": "1.8.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users."}, {"lang": "es", "value": "El componente de carga de im\u00e1genes permite archivos SVG y la expresi\u00f3n regular utilizada para eliminar etiquetas de script se puede omitir mediante el uso de un payload de Cross Site Scripting que no coincide con la expresi\u00f3n regular; un ejemplo de esto es la inclusi\u00f3n de espacios en blanco dentro de la etiqueta del script. Un atacante debe apuntar a un usuario autenticado con permisos para acceder a esta funci\u00f3n; sin embargo, una vez cargada, el payload tambi\u00e9n es accesible para usuarios no autenticados."}], "id": "CVE-2024-29833", "lastModified": "2025-04-09T15:42:02.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "info@appcheck-ng.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-26T16:15:13.063", "references": [{"source": "info@appcheck-ng.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"}, {"source": "info@appcheck-ng.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/photo-gallery/#developers"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://wordpress.org/plugins/photo-gallery/#developers"}], "sourceIdentifier": "info@appcheck-ng.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "info@appcheck-ng.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}