CVE-2024-29833 (GCVE-0-2024-29833)

Vulnerability from cvelistv5 – Published: 2024-03-26 15:30 – Updated: 2024-08-02 16:46
VLAI?
Summary
The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
Severity ?
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
10Web PhotoGallery Affected: 1.0.1 , ≤ 1.8.21 (semver)
Create a notification for this product.
Credits
AppCheck Ltd.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:17:57.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/photo-gallery/#developers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:10web:photo_gallery:1.0.1:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "photo_gallery",
            "vendor": "10web",
            "versions": [
              {
                "lessThanOrEqual": "1.8.21",
                "status": "affected",
                "version": "1.0.1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T16:46:02.579848Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:46:09.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PhotoGallery",
          "vendor": "10Web",
          "versions": [
            {
              "lessThanOrEqual": "1.8.21",
              "status": "affected",
              "version": "1.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AppCheck Ltd."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63: Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-26T15:30:28.269Z",
        "orgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae",
        "shortName": "AppCheck"
      },
      "references": [
        {
          "url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/"
        },
        {
          "url": "https://wordpress.org/plugins/photo-gallery/#developers"
        }
      ],
      "title": "WordPress Photo Gallery Plugin \u003c= 1.8.21 Stored Cross Site Scripting in UploadHandler",
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c188fdb-58e1-4908-8fce-3e437b94f1ae",
    "assignerShortName": "AppCheck",
    "cveId": "CVE-2024-29833",
    "datePublished": "2024-03-26T15:30:28.269Z",
    "dateReserved": "2024-03-20T09:56:32.456Z",
    "dateUpdated": "2024-08-02T16:46:09.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.\"}, {\"lang\": \"es\", \"value\": \"El componente de carga de im\\u00e1genes permite archivos SVG y la expresi\\u00f3n regular utilizada para eliminar etiquetas de script se puede omitir mediante el uso de un payload de Cross Site Scripting que no coincide con la expresi\\u00f3n regular; un ejemplo de esto es la inclusi\\u00f3n de espacios en blanco dentro de la etiqueta del script. Un atacante debe apuntar a un usuario autenticado con permisos para acceder a esta funci\\u00f3n; sin embargo, una vez cargada, el payload tambi\\u00e9n es accesible para usuarios no autenticados.\"}]",
      "id": "CVE-2024-29833",
      "lastModified": "2024-11-21T09:08:26.100",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"info@appcheck-ng.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}]}",
      "published": "2024-03-26T16:15:13.063",
      "references": "[{\"url\": \"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\", \"source\": \"info@appcheck-ng.com\"}, {\"url\": \"https://wordpress.org/plugins/photo-gallery/#developers\", \"source\": \"info@appcheck-ng.com\"}, {\"url\": \"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://wordpress.org/plugins/photo-gallery/#developers\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "info@appcheck-ng.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"info@appcheck-ng.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-29833\",\"sourceIdentifier\":\"info@appcheck-ng.com\",\"published\":\"2024-03-26T16:15:13.063\",\"lastModified\":\"2025-04-09T15:42:02.640\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.\"},{\"lang\":\"es\",\"value\":\"El componente de carga de im\u00e1genes permite archivos SVG y la expresi\u00f3n regular utilizada para eliminar etiquetas de script se puede omitir mediante el uso de un payload de Cross Site Scripting que no coincide con la expresi\u00f3n regular; un ejemplo de esto es la inclusi\u00f3n de espacios en blanco dentro de la etiqueta del script. Un atacante debe apuntar a un usuario autenticado con permisos para acceder a esta funci\u00f3n; sin embargo, una vez cargada, el payload tambi\u00e9n es accesible para usuarios no autenticados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@appcheck-ng.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"info@appcheck-ng.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.8.22\",\"matchCriteriaId\":\"58CE3C46-F773-4577-8A00-83AB7A8442C6\"}]}]}],\"references\":[{\"url\":\"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\",\"source\":\"info@appcheck-ng.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://wordpress.org/plugins/photo-gallery/#developers\",\"source\":\"info@appcheck-ng.com\",\"tags\":[\"Product\"]},{\"url\":\"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://wordpress.org/plugins/photo-gallery/#developers\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://wordpress.org/plugins/photo-gallery/#developers\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:17:57.411Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-29833\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-02T16:46:02.579848Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:10web:photo_gallery:1.0.1:*:*:*:*:wordpress:*:*\"], \"vendor\": \"10web\", \"product\": \"photo_gallery\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.8.21\"}], \"defaultStatus\": \"unaffected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-02T16:45:59.944Z\"}}], \"cna\": {\"title\": \"WordPress Photo Gallery Plugin \u003c= 1.8.21 Stored Cross Site Scripting in UploadHandler\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"AppCheck Ltd.\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63: Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"10Web\", \"product\": \"PhotoGallery\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.8.21\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/\"}, {\"url\": \"https://wordpress.org/plugins/photo-gallery/#developers\"}], \"x_generator\": {\"engine\": \"cveClient/1.0.15\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-79\", \"description\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"2c188fdb-58e1-4908-8fce-3e437b94f1ae\", \"shortName\": \"AppCheck\", \"dateUpdated\": \"2024-03-26T15:30:28.269Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-29833\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T16:46:09.578Z\", \"dateReserved\": \"2024-03-20T09:56:32.456Z\", \"assignerOrgId\": \"2c188fdb-58e1-4908-8fce-3e437b94f1ae\", \"datePublished\": \"2024-03-26T15:30:28.269Z\", \"assignerShortName\": \"AppCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.