Vulnerability Name:

CVE-2022-21662 (CCN-216859)

Assigned:2021-11-16
Published:2022-01-06
Updated:2022-04-12
Summary:WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
CVSS v3 Severity:5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
8.0 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
7.6 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
7.1 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2022-21662

Source: XF
Type: UNKNOWN
wordpress-cve202221662-xss(216859)

Source: CONFIRM
Type: Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889w

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20220123 [SECURITY] [DLA 2884-1] wordpress security update

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-e37e1e6c7a

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2022-8472dd59ff

Source: CCN
Type: WordPress Web site
WordPress 5.8.3 Security Release

Source: MISC
Type: Release Notes, Vendor Advisory
https://wordpress.org/news/2022/01/wordpress-5-8-3-security-release/

Source: DEBIAN
Type: Third Party Advisory
DSA-5039

Vulnerable Configuration:Configuration 1:
  • cpe:/a:wordpress:wordpress:*:*:*:*:*:*:*:* (Version < 5.8.3)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gatsbyjs:gatsby-source-wordpress:5.8.0:*:*:*:*:node.js:*:*
  • OR cpe:/a:wordpress:wordpress:3.7:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    wordpress wordpress *
    debian debian linux 9.0
    debian debian linux 10.0
    debian debian linux 11.0
    gatsbyjs gatsby-source-wordpress 5.8.0
    wordpress wordpress 3.7