Lucene search

WPScanCVE-2022-1967

HistoryJul 04, 2022 - 1:15 p.m.

CVE-2022-1967

2022-07-0413:15:08

CWE-352

WPScan

web.nvd.nist.gov

wp championship

wordpress plugin

csrf checks

admin actions

stored xss

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

26.3%

JSON

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin’s settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Affected configurations

Nvd

Vulners

Node

wp-championship_projectwp-championshipRange<9.3wordpress

VendorProductVersionCPE
wp-championship_projectwp-championship*cpe:2.3:a:wp-championship_project:wp-championship:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wp-championship_project	wp-championship	*	cpe:2.3:a:wp-championship_project:wp-championship::::::wordpress::*

CNA Affected

[
  {
    "product": "WP Championship",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "9.3",
        "status": "affected",
        "version": "9.3",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/02d25736-c796-49bd-b774-66e0e3fcf4c9

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

26.3%

JSON

Related for CVE-2022-1967