CVE-2022-21662

EUVD-2022-26879

06.01.2022, 23:15

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Cross-site Scripting

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8 HIGH	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
GitHub_M	CNA	8 HIGH	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 93%

Affected Products (NVD)

Vendor	Product	Version
wordpress	wordpress	𝑥 < 5.8.3
debian	debian_linux	9.0
debian	debian_linux	10.0
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

wordpress

bookworm	6.1.6+dfsg1-0+deb12u1 fixed
bookworm (security)	6.1.6+dfsg1-0+deb12u1 fixed
bullseye	5.7.11+dfsg1-0+deb11u1 fixed
bullseye (security)	5.7.11+dfsg1-0+deb11u1 fixed
sid	6.6.1+dfsg1-1 fixed
trixie	6.6.1+dfsg1-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

wordpress

bionic	needs-triage
focal	needs-triage
hirsute	ignored
impish	ignored
jammy	not-affected
kinetic	not-affected
lunar	not-affected
mantic	not-affected
noble	not-affected
trusty	ignored
xenial	needs-triage

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889w

https://lists.debian.org/debian-lts-announce/2022/01/msg00019.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4UNEC63UU5GEU47IIR4RMTZAHNEOJG/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DM6XPH3JN6V4NF4WBOJTOXZIVE6VKKE3/