CVE-2022-1709

🗓️ 06 Jun 2022 08:51:32Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 62 Views🌐 WEB

The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments, allowing attackers to make a logged in admin delete comments via a CSRF attack

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-1709	8 Jun 202210:15	–	attackerkb
Circl	CVE-2022-1709	8 Jun 202214:45	–	circl
CNNVD	WordPress plugin Throws SPAM Away 跨站请求伪造漏洞	8 Jun 202200:00	–	cnnvd
CNVD	WordPress Throws SPAM Away plugin cross-site request forgery vulnerability	13 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-1709 Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF	6 Jun 202208:51	–	cvelist
EUVD	EUVD-2022-24992	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1709	8 Jun 202210:15	–	nvd
Patchstack	WordPress Throws SPAM Away plugin <= 3.3 - Comment Deletion via Cross-Site Request Forgery (CSRF) vulnerability	16 May 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	8 Jun 202210:15	–	prion
RedhatCVE	CVE-2022-1709	22 May 202523:31	–	redhatcve

NVD

Vulners

Node

gti throws_spam_awayRange<3.3.1wordpress

[
  {
    "product": "Throws SPAM Away",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.3.1",
        "status": "affected",
        "version": "3.3.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/ac290535-d9ec-459a-abc3-27cd78eb54fc

Parameter	Position	Path	Description	CWE
c_all	request body	wp-admin/admin.php?page=throws-spam-away%2Fthrows_spam_away_comments.php	CSRF vulnerability: plugin deletes comments without CSRF checks via POST to delete all comments.	CWE-352
all	request body	wp-admin/admin.php?page=throws-spam-away%2Fthrows_spam_away_comments.php	CSRF vulnerability: plugin deletes comments without CSRF checks via POST to delete all comments.	CWE-352
Submit	request body	wp-admin/admin.php?page=throws-spam-away%2Fthrows_spam_away_comments.php	CSRF vulnerability: plugin deletes comments without CSRF checks via POST to delete all comments.	CWE-352
c_pend	request body	wp-admin/admin.php?page=throws-spam-away%2Fthrows_spam_away_comments.php	CSRF vulnerability: plugin deletes pending comments without CSRF checks via POST.	CWE-352
pend	request body	wp-admin/admin.php?page=throws-spam-away%2Fthrows_spam_away_comments.php	CSRF vulnerability: plugin deletes pending comments without CSRF checks via POST.	CWE-352
Submit	request body	wp-admin/admin.php?page=throws-spam-away%2Fthrows_spam_away_comments.php	CSRF vulnerability: plugin deletes pending comments without CSRF checks via POST.	CWE-352

21 Nov 2024 06:41Current

4.4Medium risk

Vulners AI Score4.4

CVSS 3.14.3

CVSS 24.3

EPSS0.00103

CWE-352