CVE-2022-2224

2022-07-1817:15:09

[email protected]

web.nvd.nist.gov

cve-2022-2224

wordpress

plugin

gallery for social photo

csrf

vulnerability

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.1%

JSON

The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in the function gifeed_duplicate_feed. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.

Affected configurations

Vulners

NVD

Node

ghozylabgallery_for_social_photoRange≤1.0.0.27

VendorProductVersionCPE
ghozylabgallery_for_social_photo*cpe:2.3:a:ghozylab:gallery_for_social_photo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ghozylab	gallery_for_social_photo	*	cpe:2.3:a:ghozylab:gallery_for_social_photo::::::::

CNA Affected

[
  {
    "vendor": "ghozylab",
    "product": "Gallery for Social Photo",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.0.0.27",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2749351%40feed-instagram-lite&new=2749351%40feed-instagram-lite&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/c6683edc-8c77-446c-bd7e-e97b8c5d0c57?source=cve

www.wordfence.com/vulnerability-advisories/#CVE-2022-2224