CVE-2022-2389

🗓️ 22 Aug 2022 15:02:49Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 54 Views🌐 WEB

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketin

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2022-2389	22 Aug 202215:15	–	attackerkb
CNNVD	WordPress plugin Automations 安全漏洞	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2389 Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation	22 Aug 202215:02	–	cvelist
NVD	CVE-2022-2389	22 Aug 202215:15	–	nvd
OSV	CVE-2022-2389	22 Aug 202215:15	–	osv
Patchstack	WordPress Automations By Autonami plugin <= 2.1.1 - Automation Creation vulnerability	26 Jul 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-16315 · Autonami · Abandoned Cart Recovery For Woocommerce	22 Aug 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2389	22 May 202523:56	–	redhatcve
wpexploit	Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation	26 Jul 202200:00	–	wpexploit

NVD

Vulners

Node

funnelkit funnelkit_automationsRange<2.1.2wordpress

[
  {
    "product": "Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.1.2",
        "status": "affected",
        "version": "2.1.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/e70f00b7-6251-476e-9297-60af509e6ad9

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	AJAX endpoint vulnerable to missing authorization/CSRF checks allowing authenticated users to perform actions (e.g., create automations) without proper authorization.	CWE-352, CWE-862
file	request body	wp-admin/admin-ajax.php	AJAX endpoint vulnerable to missing authorization/CSRF checks allowing authenticated users to perform actions (e.g., create automations) without proper authorization.	CWE-352, CWE-862