Threat Investigation
Request a demo

CVE-2021-42365

Medium

Description

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

SeverityMedium
CVSS4.8
Exploit probability—
ProductAsgaros Forum
PublishedNov 29, 2021
First seenNov 29, 2021
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • asgaros asgaros_forum1.15.14 or later

Affected products

ProductAffected versionsFixed in
asgaros asgaros_forumv < 1.15.141.15.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.