Lucene search

WPScanCVE-2022-1093

HistoryMay 23, 2022 - 8:16 a.m.

CVE-2022-1093

2022-05-2308:16:06

CWE-79

WPScan

web.nvd.nist.gov

cve-2022-1093

wp meta seo

wordpress plugin

security vulnerability

arbitrary javascript

privilege escalation

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.

Affected configurations

Nvd

Vulners

Node

joomunitedwp_meta_seoRange<4.4.7wordpress

VendorProductVersionCPE
joomunitedwp_meta_seo*cpe:2.3:a:joomunited:wp_meta_seo:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
joomunited	wp_meta_seo	*	cpe:2.3:a:joomunited:wp_meta_seo::::::wordpress::*

CNA Affected

[
  {
    "product": "WP Meta SEO",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.4.7",
        "status": "affected",
        "version": "4.4.7",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/57017050-811e-474d-8256-33d19d4c0553

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2022-1093