Lucene search

WPScanCVE-2022-1577

HistoryJun 08, 2022 - 10:15 a.m.

CVE-2022-1577

2022-06-0810:15:09

CWE-352

WPScan

web.nvd.nist.gov

cve-2022-1577

wordpress

plugin

vulnerability

csrf

security

backup

nvd

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

32.1%

JSON

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule

Affected configurations

Nvd

Vulners

Node

deliciousbrainsdatabase_backupRange<2.5.2wordpress

VendorProductVersionCPE
deliciousbrainsdatabase_backup*cpe:2.3:a:deliciousbrains:database_backup:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
deliciousbrains	database_backup	*	cpe:2.3:a:deliciousbrains:database_backup::::::wordpress::*

CNA Affected

[
  {
    "product": "Database Backup for WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.5.2",
        "status": "affected",
        "version": "2.5.2",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346

Social References

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

32.1%

JSON

Related for CVE-2022-1577