CVE-2022-2355

2022-08-0814:15:08

CWE-352

[email protected]

web.nvd.nist.gov

cve-2022-2355

easy username updater

wordpress

plugin

csrf

security vulnerability

admin

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

26.5%

JSON

The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user’s username includes the admin

Affected configurations

Vulners

NVD

Node

easy_username_updater_projecteasy_username_updaterRange<1.0.5

VendorProductVersionCPE
easy_username_updater_projecteasy_username_updater*cpe:2.3:a:easy_username_updater_project:easy_username_updater:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
easy_username_updater_project	easy_username_updater	*	cpe:2.3:a:easy_username_updater_project:easy_username_updater::::::::

CNA Affected

[
  {
    "product": "Easy Username Updater",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.0.5",
        "status": "affected",
        "version": "1.0.5",
        "versionType": "custom"
      }
    ]
  }
]