Lucene search

WPScanCVE-2022-0163

HistoryMar 07, 2022 - 9:15 a.m.

CVE-2022-0163

2022-03-0709:15:08

CWE-862

WPScan

web.nvd.nist.gov

cve-2022-0163

wordpress plugin

smart forms

authorization bypass

information disclosure

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form’s data, which could include sensitive information such as PII depending on the form.

Affected configurations

Nvd

Vulners

Node

rednaosmart_formsRange<2.6.71wordpress

VendorProductVersionCPE
rednaosmart_forms*cpe:2.3:a:rednao:smart_forms:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
rednao	smart_forms	*	cpe:2.3:a:rednao:smart_forms::::::wordpress::*

CNA Affected

[
  {
    "product": "Smart Forms – when you need more than just a contact form",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.6.71",
        "status": "affected",
        "version": "2.6.71",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/2b6b0731-4515-498a-82bd-d416f5885268

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Related for CVE-2022-0163