Lucene search

PatchstackCVE-2022-27851

HistoryApr 15, 2022 - 5:15 p.m.

CVE-2022-27851

2022-04-1517:15:08

CWE-352

Patchstack

web.nvd.nist.gov

cve-2022-27851

csrf

use any font

wordpress plugin

api key

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

20.8%

JSON

Cross-Site Request Forgery (CSRF) in Use Any Font (WordPress plugin) <= 6.1.7 allows an attacker to deactivate the API key.

Affected configurations

Nvd

Vulners

Node

dineshkarkiuse_any_fontRange≤6.1.7wordpress

VendorProductVersionCPE
dineshkarkiuse_any_font*cpe:2.3:a:dineshkarki:use_any_font:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
dineshkarki	use_any_font	*	cpe:2.3:a:dineshkarki:use_any_font::::::wordpress::*

CNA Affected

[
  {
    "product": "Use Any Font | Custom Font Uploader (WordPress plugin)",
    "vendor": "Dnesscarkey",
    "versions": [
      {
        "lessThanOrEqual": "6.1.7",
        "status": "affected",
        "version": "<= 6.1.7",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/use-any-font/wordpress-use-any-font-plugin-6-1-7-cross-site-request-forgery-csrf-vulnerability

wordpress.org/plugins/use-any-font/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

20.8%

JSON

Related for CVE-2022-27851