Lucene search

K
cve[email protected]CVE-2022-1020
HistoryApr 18, 2022 - 6:15 p.m.

CVE-2022-1020

2022-04-1818:15:08
CWE-352
CWE-862
web.nvd.nist.gov
49
woocommerce
wordpress
plugin
vulnerability
csrf
authentication
nvd
cve-2022-1020

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.028 Low

EPSS

Percentile

90.7%

The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument

Affected configurations

Vulners
NVD
Node
wcproducttablewoocommerce_product_table_liteRange<3.0.2
OR
wcproducttablewoocommerce_product_table_liteRange<3.1.2
VendorProductVersionCPE
wcproducttablewoocommerce_product_table_lite*cpe:2.3:a:wcproducttable:woocommerce_product_table_lite:*:*:*:*:*:*:*:*
wcproducttablewoocommerce_product_table_lite*cpe:2.3:a:wcproducttable:woocommerce_product_table_lite:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Product Table for WooCommerce (wooproducttable)",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.0.2*",
        "status": "affected",
        "version": "3.0.2",
        "versionType": "custom"
      },
      {
        "lessThan": "3.1.2",
        "status": "affected",
        "version": "3.1.2",
        "versionType": "custom"
      }
    ]
  }
]

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.028 Low

EPSS

Percentile

90.7%