Lucene search

WPScanCVE-2022-3750

HistoryNov 21, 2022 - 11:15 a.m.

CVE-2022-3750

2022-11-2111:15:20

CWE-352

WPScan

web.nvd.nist.gov

csrf

vulnerability

deletion

posts

unauthorized

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.

Affected configurations

Nvd

Vulners

Node

inkthemesask_meRange<6.8.7wordpress

VendorProductVersionCPE
inkthemesask_me*cpe:2.3:a:inkthemes:ask_me:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
inkthemes	ask_me	*	cpe:2.3:a:inkthemes:ask_me::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Ask me",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "6.8.7"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/5019db80-0356-497d-b488-a26a5de78676

Social References

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

Related for CVE-2022-3750