CVE-2022-0594

2022-07-2513:15:08

CWE-863

[email protected]

web.nvd.nist.gov

cve-2022-0594

wordpress plugin

security vulnerability

ajax action

unauthenticated access

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.5%

JSON

The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.

Affected configurations

Vulners

NVD

Node

ultimatelysocialsocial_media_share_buttons_\&_social_sharing_iconsRange<9.7.6

VendorProductVersionCPE
ultimatelysocialsocial_media_share_buttons_\&_social_sharing_icons*cpe:2.3:a:ultimatelysocial:social_media_share_buttons_\&_social_sharing_icons:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ultimatelysocial	social_media_share_buttons_\&_social_sharing_icons	*	cpe:2.3:a:ultimatelysocial:social_media_share_buttons_\&_social_sharing_icons::::::::

CNA Affected

[
  {
    "product": "Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "9.7.6",
        "status": "affected",
        "version": "9.7.6",
        "versionType": "custom"
      }
    ]
  }
]