Vulnerability Description
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Filemanagerpro | File Manager | < 7.1 |
Related Weaknesses (CWE)
References
- https://n4nj0.github.io/advisories/wordpress-plugin-wp-file-manager-i/ExploitThird Party Advisory
- https://plugins.trac.wordpress.org/changeset/2476829/PatchThird Party Advisory
- https://wpscan.com/vulnerability/1cf3d256-cf4b-4d1f-9ed8-e2cc6392d8d8Third Party Advisory
- https://n4nj0.github.io/advisories/wordpress-plugin-wp-file-manager-i/ExploitThird Party Advisory
- https://plugins.trac.wordpress.org/changeset/2476829/PatchThird Party Advisory
- https://wpscan.com/vulnerability/1cf3d256-cf4b-4d1f-9ed8-e2cc6392d8d8Third Party Advisory
FAQ
What is CVE-2021-24177?
CVE-2021-24177 is a vulnerability with a CVSS score of 5.4 (MEDIUM). In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted ...
How severe is CVE-2021-24177?
CVE-2021-24177 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24177?
Check the references section above for vendor advisories and patch information. Affected products include: Filemanagerpro File Manager.