CVE-2022-2846

🗓️ 16 Aug 2022 00:00:00Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 92 Views🌐 WEB

The Calendar Event Multi View WordPress plugin before 1.4.07 is vulnerable to unauthenticated event creation with potential Cross-Site Scripting

Reporter	Title	Published	Views	Family All 16
zdt	Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to XSS Vulnerability	5 Apr 202300:00	–	zdt
Circl	CVE-2022-2846	16 Aug 202222:39	–	circl
CNNVD	WordPress plugin Calendar Event Multi View 跨站请求伪造漏洞	16 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2846 Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS	16 Aug 202200:00	–	cvelist
Exploit DB	Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)	5 Apr 202300:00	–	exploitdb
EUVD	EUVD-2022-35080	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2846	16 Aug 202219:15	–	nvd
OSV	CVE-2022-2846	16 Aug 202219:15	–	osv
Packet Storm	Calendar Event Multi View 1.4.07 Cross Site Scripting	5 Apr 202300:00	–	packetstorm
Prion	Cross site scripting	16 Aug 202219:15	–	prion

NVD

Vulners

Node

dwbooster calendar_event_multi_viewRange<1.4.07wordpress

[
  {
    "vendor": "Unknown",
    "product": "Calendar Event Multi View",
    "versions": [
      {
        "version": "1.4.07",
        "status": "affected",
        "lessThan": "1.4.07",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c
packetstormsecurity	www.packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
Subject	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
Description	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
Location	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
stpartdate	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
stparttime	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
etpartdate	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
etparttime	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
stpartdatelast	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
etpartdatelast	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862
stparttimelast	request body	/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails	XSS via unsanitized event fields in unauthenticated event creation endpoint (Subject field can inject script via the form payload).	CWE-79, CWE-352, CWE-862