Lucene search

PatchstackCVE-2022-29451

HistoryApr 29, 2022 - 5:15 p.m.

CVE-2022-29451

2022-04-2917:15:22

CWE-352

CWE-434

Patchstack

web.nvd.nist.gov

cve-2022-29451

cross-site request forgery

csrf

arbitrary file upload

rara one click demo import

wordpress

security vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

39.6%

JSON

Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory.

Affected configurations

Nvd

Vulners

Node

rarathemesrara_one_click_demo_importRange<1.3.0wordpress

VendorProductVersionCPE
rarathemesrara_one_click_demo_import*cpe:2.3:a:rarathemes:rara_one_click_demo_import:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
rarathemes	rara_one_click_demo_import	*	cpe:2.3:a:rarathemes:rara_one_click_demo_import::::::wordpress::*

CNA Affected

[
  {
    "product": "Rara One Click Demo Import (WordPress plugin)",
    "vendor": "Raratheme",
    "versions": [
      {
        "lessThanOrEqual": "1.2.9",
        "status": "affected",
        "version": "<= 1.2.9",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/rara-one-click-demo-import/wordpress-rara-one-click-demo-import-plugin-1-2-9-cross-site-request-forgery-csrf-leads-to-arbitrary-file-upload-vulnerability

wordpress.org/plugins/rara-one-click-demo-import/#developers

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

39.6%

JSON

Related for CVE-2022-29451