CVE-2024-29833 (GCVE-0-2024-29833)
Vulnerability from cvelistv5
Published
2024-03-26 15:30
Modified
2024-08-02 16:46
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
References
info@appcheck-ng.comhttps://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/Exploit, Third Party Advisory
info@appcheck-ng.comhttps://wordpress.org/plugins/photo-gallery/#developersProduct
af854a3a-2127-422b-91ae-364da2661108https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/plugins/photo-gallery/#developersProduct
Impacted products
Vendor Product Version
10Web PhotoGallery Version: 1.0.1   ≤ 1.8.21
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:17:57.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/photo-gallery/#developers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:10web:photo_gallery:1.0.1:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "photo_gallery",
            "vendor": "10web",
            "versions": [
              {
                "lessThanOrEqual": "1.8.21",
                "status": "affected",
                "version": "1.0.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T16:46:02.579848Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:46:09.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PhotoGallery",
          "vendor": "10Web",
          "versions": [
            {
              "lessThanOrEqual": "1.8.21",
              "status": "affected",
              "version": "1.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AppCheck Ltd."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63: Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-26T15:30:28.269Z",
        "orgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae",
        "shortName": "AppCheck"
      },
      "references": [
        {
          "url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"
        },
        {
          "url": "https://wordpress.org/plugins/photo-gallery/#developers"
        }
      ],
      "title": "WordPress Photo Gallery Plugin \u003c= 1.8.21 Stored Cross Site Scripting in UploadHandler",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae",
    "assignerShortName": "AppCheck",
    "cveId": "CVE-2024-29833",
    "datePublished": "2024-03-26T15:30:28.269Z",
    "dateReserved": "2024-03-20T09:56:32.456Z",
    "dateUpdated": "2024-08-02T16:46:09.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-29833\",\"sourceIdentifier\":\"info@appcheck-ng.com\",\"published\":\"2024-03-26T16:15:13.063\",\"lastModified\":\"2025-04-09T15:42:02.640\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.\"},{\"lang\":\"es\",\"value\":\"El componente de carga de im\u00e1genes permite archivos SVG y la expresi\u00f3n regular utilizada para eliminar etiquetas de script se puede omitir mediante el uso de un payload de Cross Site Scripting que no coincide con la expresi\u00f3n regular; un ejemplo de esto es la inclusi\u00f3n de espacios en blanco dentro de la etiqueta del script. Un atacante debe apuntar a un usuario autenticado con permisos para acceder a esta funci\u00f3n; sin embargo, una vez cargada, el payload tambi\u00e9n es accesible para usuarios no autenticados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@appcheck-ng.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"info@appcheck-ng.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.8.22\",\"matchCriteriaId\":\"58CE3C46-F773-4577-8A00-83AB7A8442C6\"}]}]}],\"references\":[{\"url\":\"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\",\"source\":\"info@appcheck-ng.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://wordpress.org/plugins/photo-gallery/#developers\",\"source\":\"info@appcheck-ng.com\",\"tags\":[\"Product\"]},{\"url\":\"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://wordpress.org/plugins/photo-gallery/#developers\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://wordpress.org/plugins/photo-gallery/#developers\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:17:57.411Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-29833\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-02T16:46:02.579848Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:10web:photo_gallery:1.0.1:*:*:*:*:wordpress:*:*\"], \"vendor\": \"10web\", \"product\": \"photo_gallery\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.8.21\"}], \"defaultStatus\": \"unaffected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-02T16:45:59.944Z\"}}], \"cna\": {\"title\": \"WordPress Photo Gallery Plugin \u003c= 1.8.21 Stored Cross Site Scripting in UploadHandler\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"AppCheck Ltd.\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63: Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"10Web\", \"product\": \"PhotoGallery\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.8.21\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\"}, {\"url\": \"https://wordpress.org/plugins/photo-gallery/#developers\"}], \"x_generator\": {\"engine\": \"cveClient/1.0.15\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-79\", \"description\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"2c188fdb-58e1-4908-8fce-3e437b94f1ae\", \"shortName\": \"AppCheck\", \"dateUpdated\": \"2024-03-26T15:30:28.269Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-29833\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T16:46:09.578Z\", \"dateReserved\": \"2024-03-20T09:56:32.456Z\", \"assignerOrgId\": \"2c188fdb-58e1-4908-8fce-3e437b94f1ae\", \"datePublished\": \"2024-03-26T15:30:28.269Z\", \"assignerShortName\": \"AppCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.