CVE-2022-45066

🗓️ 17 Nov 2022 22:05:03Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 47 Views🌐 WEB

Auth. (subscriber+) Broken Access Control in WooSwipe WooCommerce Gallery plugin <= 2.0.

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin WooSwipe WooCommerce Gallery 安全漏洞	17 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-45066 WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability	17 Nov 202222:05	–	cvelist
EUVD	EUVD-2022-47987	3 Oct 202520:07	–	euvd
NVD	CVE-2022-45066	17 Nov 202223:15	–	nvd
OSV	CVE-2022-45066	17 Nov 202223:15	–	osv
Patchstack	WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability	17 Nov 202200:00	–	patchstack
Prion	Improper access control	17 Nov 202223:15	–	prion
Positive Technologies	PT-2022-27397 · WordPress · Wooswipe Woocommerce Gallery	17 Nov 202200:00	–	ptsecurity
wpexploit	WooSwipe WooCommerce Gallery <= 2.0.1 - Subscriber+ Settings Update	17 Nov 202200:00	–	wpexploit
WPVulnDB	WooSwipe WooCommerce Gallery <= 2.0.1 - Subscriber+ Settings Update	17 Nov 202200:00	–	wpvulndb

NVD

Vulners

Node

thriveweb wooswipe_woocommerce_galleryRange≤2.0.1wordpress

[
  {
    "product": "WooSwipe WooCommerce Gallery (WordPress plugin)",
    "vendor": "Thrive Website Design",
    "versions": [
      {
        "lessThanOrEqual": "2.0.1",
        "status": "affected",
        "version": "<= 2.0.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/vulnerability/wooswipe/wordpress-wooswipe-woocommerce-gallery-plugin-2-0-1-auth-broken-access-control-vulnerability

Parameter	Position	Path	Description	CWE
white_theme	request body	wp-admin/admin.php?page=wooswipe-options	Unauthorized update of plugin settings via admin options page (auth bypass).	CWE-264
icon_bg_color	request body	wp-admin/admin.php?page=wooswipe-options	Unauthorized update of plugin settings via admin options page (auth bypass).	CWE-264
icon_stroke_color	request body	wp-admin/admin.php?page=wooswipe-options	Unauthorized update of plugin settings via admin options page (auth bypass).	CWE-264
wooswipe_save	request body	wp-admin/admin.php?page=wooswipe-options	Unauthorized update of plugin settings via admin options page (auth bypass).	CWE-264