Zephyr Project Manager <= 3.2.42 - Missing Authorization to Cross-Site Scripting
2022-08-29 00:00
WPScanTeamStrategic Overview
StatusPatched in 3.2.5
Affected PluginZephyr Project Manager
Affected Version
3.2.4 – 3.2.42 · 3 branchesCVSS7.2High
CVE
N/AVulnerability Overview
The Zephyr Project Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check and lack of authentication/authorization on its REST endpoints in versions up to, and including, 3.2.42. This makes it possible for unauthenticated attackers to utilize them. Additionally, user input is not properly sanitized leading to Stored Cross-Site Scripting.
Technical Analysis
REMEDIATION: Update to version 3.2.5, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C