CVE-2022-4550

2023-02-2716:15:11

CWE-290

[email protected]

web.nvd.nist.gov

cve-2022-4550

user activity plugin

wordpress

ip spoofing

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

29.5%

JSON

The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing

Affected configurations

Vulners

NVD

Node

user_activity_projectuser_activityRange≤1.0.1

VendorProductVersionCPE
user_activity_projectuser_activity*cpe:2.3:a:user_activity_project:user_activity:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
user_activity_project	user_activity	*	cpe:2.3:a:user_activity_project:user_activity::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "User Activity",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "1.0.1"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]