CVE-2022-2101 Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting

What is CVE-2022-2101?

CVE-2022-2101 is a medium-severity cross-site scripting vulnerability in codename065 Download Manager, published on 18 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page.

Weakness: CWE-79

Which versions are affected by CVE-2022-2101?

It affects 1 product.

Products include W3eden Download Manager.

How do I fix CVE-2022-2101?

No fix has been published for CVE-2022-2101 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-2101 being exploited?

There is no known exploitation of CVE-2022-2101 in the wild and no public exploit code.

Other vulnerabilities in codename065 Download Manager

• CVE-2022-2436 Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization High 8.8
• CVE-2021-25069 WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS High 8.8
• CVE-2014-9260 Missing authorization in n/a High 8.8
• CVE-2022-2431 Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion High 8.1
• CVE-2024-2098 Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gjv4-fmq6-6x2x.