CVE-2022-33901

2022-07-2217:15:08

[email protected]

web.nvd.nist.gov

cve-2022-33901

unauthenticated

arbitrary file read

multisafepay

woocommerce

wordpress

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.008 Low

EPSS

Percentile

81.2%

JSON

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.

Affected configurations

Vulners

NVD

Node

multisafepaymultisafepay_plugin_for_woocommerceRange≤4.13.1

VendorProductVersionCPE
multisafepaymultisafepay_plugin_for_woocommerce*cpe:2.3:a:multisafepay:multisafepay_plugin_for_woocommerce:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
multisafepay	multisafepay_plugin_for_woocommerce	*	cpe:2.3:a:multisafepay:multisafepay_plugin_for_woocommerce::::::::

CNA Affected

[
  {
    "product": "MultiSafepay plugin for WooCommerce (WordPress plugin)",
    "vendor": "MultiSafepay",
    "versions": [
      {
        "lessThanOrEqual": "4.13.1",
        "status": "affected",
        "version": "<= 4.13.1",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/multisafepay/wordpress-multisafepay-plugin-for-woocommerce-plugin-4-13-1-unauthenticated-arbitrary-file-read-vulnerability

wordpress.org/plugins/multisafepay/#developers