Lucene search

PatchstackCVE-2022-29430

HistoryMay 20, 2022 - 9:15 p.m.

CVE-2022-29430

2022-05-2021:15:10

CWE-352

CWE-79

Patchstack

web.nvd.nist.gov

cve-2022-29430

cross-site scripting

xss

kubiq

png to jpg

wordpress

csrf

csrf vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

20.8%

JSON

Cross-Site Scripting (XSS) vulnerability in KubiQ’s PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable parameter &jpg_quality.

Affected configurations

Nvd

Vulners

Node

png_to_jpg_projectpng_to_jpgRange≤4.0wordpress

VendorProductVersionCPE
png_to_jpg_projectpng_to_jpg*cpe:2.3:a:png_to_jpg_project:png_to_jpg:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
png_to_jpg_project	png_to_jpg	*	cpe:2.3:a:png_to_jpg_project:png_to_jpg::::::wordpress::*

CNA Affected

[
  {
    "product": "PNG to JPG (WordPress plugin)",
    "vendor": "KubiQ",
    "versions": [
      {
        "lessThanOrEqual": "4.0",
        "status": "affected",
        "version": "<= 4.0",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/png-to-jpg/wordpress-png-to-jpg-plugin-4-0-cross-site-request-forgery-csrf-leading-to-persistent-cross-site-scripting-xss-vulnerability

wordpress.org/plugins/png-to-jpg/#developers

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

20.8%

JSON

Related for CVE-2022-29430