CVE-2022-1663

2022-08-2918:15:08

CWE-200

[email protected]

web.nvd.nist.gov

cve-2022-1663

stop spam comments

wordpress

plugin

security vulnerability

javascript

access token

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

40.3%

JSON

The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.

Affected configurations

Vulners

NVD

Node

stop_spam_comments_projectstop_spam_commentsRange≤0.2.1.2

VendorProductVersionCPE
stop_spam_comments_projectstop_spam_comments*cpe:2.3:a:stop_spam_comments_project:stop_spam_comments:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
stop_spam_comments_project	stop_spam_comments	*	cpe:2.3:a:stop_spam_comments_project:stop_spam_comments::::::::

CNA Affected

[
  {
    "product": "Stop Spam Comments",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "0.2.1.2",
        "status": "affected",
        "version": "0.2.1.2",
        "versionType": "custom"
      }
    ]
  }
]