Lucene search

WPScanCVE-2022-1029

HistoryJun 27, 2022 - 9:15 a.m.

CVE-2022-1029

2022-06-2709:15:08

CWE-79

WPScan

web.nvd.nist.gov

cve-2022-1029

limit login attempts

wordpress

xss

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

Affected configurations

Nvd

Vulners

Node

miniorangelimit_login_attemptsRange<4.0.72wordpress

VendorProductVersionCPE
miniorangelimit_login_attempts*cpe:2.3:a:miniorange:limit_login_attempts:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
miniorange	limit_login_attempts	*	cpe:2.3:a:miniorange:limit_login_attempts::::::wordpress::*

CNA Affected

[
  {
    "product": "Limit Login Attempts",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.0.72",
        "status": "affected",
        "version": "4.0.72",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/0e74eeb4-89e2-4873-904f-ad4f25c4a8ba

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2022-1029