Lucene search

WPScanCVE-2022-0914

HistoryApr 11, 2022 - 3:15 p.m.

CVE-2022-0914

2022-04-1115:15:08

CWE-352

WPScan

web.nvd.nist.gov

cve-2022-0914

export all urls

wordpress plugin

csrf

security vulnerability

nvd

csv vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

42.8%

JSON

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example

Affected configurations

Nvd

Vulners

Node

atlasgondalexport_all_urlsRange<4.3wordpress

VendorProductVersionCPE
atlasgondalexport_all_urls*cpe:2.3:a:atlasgondal:export_all_urls:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
atlasgondal	export_all_urls	*	cpe:2.3:a:atlasgondal:export_all_urls::::::wordpress::*

CNA Affected

[
  {
    "product": "Export All URLs",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.3",
        "status": "affected",
        "version": "4.3",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/c328be28-75dd-43db-a5b9-c1ba0636c930

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

42.8%

JSON

Related for CVE-2022-0914