Lucene search

VulDBCVELIST:CVE-2022-4604

HistoryDec 18, 2022 - 12:00 a.m.

CVE-2022-4604 wp-english-wp-admin Plugin english-wp-admin.php register_endpoints cross-site request forgery

2022-12-1800:00:00

CWE-352

VulDB

www.cve.org

cross-site request forgery

vulnerability

wp-english-wp-admin plugin

register_endpoints

remote attack

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.4%

JSON

A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoints of the file english-wp-admin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.5.2 is able to address this issue. The name of the patch is ad4ba171c974c65c3456e7c6228f59f40783b33d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216199.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "wp-english-wp-admin Plugin",
    "versions": [
      {
        "version": "1.5.0",
        "status": "affected"
      },
      {
        "version": "1.5.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/khromov/wp-english-wp-admin/commit/ad4ba171c974c65c3456e7c6228f59f40783b33d

github.com/khromov/wp-english-wp-admin/releases/tag/1.5.2

vuldb.com/?id.216199

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.4%

JSON

Related for CVELIST:CVE-2022-4604