// For flags

CVE-2021-24879

SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.

El plugin SupportCandy de WordPress versiones anteriores a 2.2.7, no presenta una comprobación CSRF en la acción AJAX wpsc_tickets, ni presenta ningún tipo de saneo o escape en algunos de los campos filter, lo que podría permitir a atacantes hacer que un usuario conectado que tenga acceso al panel de listas de tickets establezca un filtro arbitrario (almacenado en sus cookies) con una carga útil de tipo XSS en él

The SupportCandy – Helpdesk & Support Ticket System WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.

*Credits: apple502j
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-01-14 CVE Reserved
  • 2022-01-05 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Supportcandy
Search vendor "Supportcandy"
 Supportcandy
Search vendor "Supportcandy" for product "Supportcandy"
 < 2.2.7
Search vendor "Supportcandy" for product "Supportcandy" and version " < 2.2.7"
wordpress
Affected