Lucene search

WPScanCVE-2022-1688

HistoryJun 08, 2022 - 10:15 a.m.

CVE-2022-1688

2022-06-0810:15:10

CWE-89

WPScan

web.nvd.nist.gov

note press

wordpress

plugin

sql injections

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

AI Score

3.9

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections

Affected configurations

Nvd

Vulners

Node

datainterlocknote_pressRange≤0.1.10wordpress

VendorProductVersionCPE
datainterlocknote_press*cpe:2.3:a:datainterlock:note_press:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
datainterlock	note_press	*	cpe:2.3:a:datainterlock:note_press::::::wordpress::*

CNA Affected

[
  {
    "product": "Note Press",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "0.1.10",
        "status": "affected",
        "version": "0.1.10",
        "versionType": "custom"
      }
    ]
  }
]

References

bulletin.iese.de/post/note-press_0-1-10_1

wpscan.com/vulnerability/63d4444b-9b04-47f5-a692-c6c6c8ea7d92

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

AI Score

3.9

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

Related for CVE-2022-1688