Lucene search

[email protected]CVE-2022-1760

HistoryJan 16, 2024 - 4:15 p.m.

CVE-2022-1760

2024-01-1616:15:09

CWE-352

[email protected]

web.nvd.nist.gov

cve-2022-1760

core control

wordpress plugin

csrf

security vulnerability

nvd

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

7 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

15.6%

JSON

The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CPENameOperatorVersion
dd32:core_controldd32 core controlle1.2.1
dd32:core_controldd32 core controleq1.2.1
dd32:core_controldd32 core controleq0.5
dd32:core_controldd32 core controleq1.0
dd32:core_controldd32 core controleq0.9
dd32:core_controldd32 core controleq1.1
dd32:core_controldd32 core controleq0.9.2
dd32:core_controldd32 core controleq0.8
dd32:core_controldd32 core controleq0.6
dd32:core_controldd32 core controleq0.7

CPE	Name	Operator	Version
dd32:core_control	dd32 core control	le	1.2.1
dd32:core_control	dd32 core control	eq	1.2.1
dd32:core_control	dd32 core control	eq	0.5
dd32:core_control	dd32 core control	eq	1.0
dd32:core_control	dd32 core control	eq	0.9
dd32:core_control	dd32 core control	eq	1.1
dd32:core_control	dd32 core control	eq	0.9.2
dd32:core_control	dd32 core control	eq	0.8
dd32:core_control	dd32 core control	eq	0.6
dd32:core_control	dd32 core control	eq	0.7

Rows per page:

1-10 of 121

References

wpscan.com/vulnerability/c7906b1d-25c9-4f34-bd02-66824878b88e/

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

7 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

15.6%

JSON

Related for CVE-2022-1760

patchstack1 wpvulndb1 prion1 wpexploit1