CVE-2022-2389

🗓️ 22 Aug 2022 15:02:49Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 82 Views🌐 WEB

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketin

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2022-2389	22 Aug 202215:15	–	attackerkb
CNNVD	WordPress plugin Automations 安全漏洞	22 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2389 Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation	22 Aug 202215:02	–	cvelist
NVD	CVE-2022-2389	22 Aug 202215:15	–	nvd
OSV	CVE-2022-2389	22 Aug 202215:15	–	osv
Patchstack	WordPress Automations By Autonami plugin <= 2.1.1 - Automation Creation vulnerability	26 Jul 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	22 Aug 202215:15	–	prion
Positive Technologies	PT-2022-16315 · Autonami · Abandoned Cart Recovery For Woocommerce	22 Aug 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-2389: Missing Authorization	22 Aug 202200:00	–	rapid7
RedhatCVE	CVE-2022-2389	22 May 202523:56	–	redhatcve

NVD

Node

funnelkit funnelkit_automationsRange<2.1.2wordpress

[
  {
    "product": "Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.1.2",
        "status": "affected",
        "version": "2.1.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/e70f00b7-6251-476e-9297-60af509e6ad9

Parameter	Position	Path	Description	CWE
action	query param	/wp-admin/admin-ajax.php?action=bwf_import_automations_json_file	Missing authorization and CSRF checks on an AJAX action (bwf_import_automations_json_file) in the Autonami WordPress plugin, allowing any authenticated user to create automations by uploading a crafted JSON payload.	CWE-352, CWE-862
file	query param	/wp-admin/admin-ajax.php?action=bwf_import_automations_json_file	Missing authorization and CSRF checks on an AJAX action (bwf_import_automations_json_file) in the Autonami WordPress plugin, allowing any authenticated user to create automations by uploading a crafted JSON payload.	CWE-352, CWE-862