CVE-2021-24584: motopress timetable_and_event_schedule Cross-site Scripting

Vulnerability summary

CVE-2021-24584 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in motopress timetable_and_event_schedule. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.2% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.4.2.

Timeline

1. 20-09-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.