CVE-2021-24923 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS

What is CVE-2021-24923?

CVE-2021-24923 is a medium-severity cross-site scripting vulnerability in Unknown Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Weakness: CWE-79

Which versions are affected by CVE-2021-24923?

It affects 1 product.

Products include Brevo Newsletter\, Smtp\, Email Marketing and Subscribe.

How do I fix CVE-2021-24923?

No fix has been published for CVE-2021-24923 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24923 being exploited?

There is no known exploitation of CVE-2021-24923 in the wild and no public exploit code.

Other vulnerabilities in Unknown Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue

• CVE-2024-35668 Cross-site scripting in Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue High 7.1
• CVE-2023-2472 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.61 - Reflected XSS Medium 6.1
• CVE-2021-24874 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2024-8477 Cross-site request forgery in Brevo – Email, SMS, Web Push, Chat, and more. Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pfq2-x69w-983r.