Lucene search

WPScanCVE-2022-3923

HistoryJan 09, 2023 - 11:15 p.m.

CVE-2022-3923

2023-01-0923:15:26

CWE-862

WPScan

web.nvd.nist.gov

cve-2022-3923

activecampaign

woocommerce

wordpress plugin

ajax

authorisation check

security vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

25.4%

JSON

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.

Affected configurations

Nvd

Vulners

Node

activecampaignactivecampaign_for_woocommerceRange<1.9.8wordpress

VendorProductVersionCPE
activecampaignactivecampaign_for_woocommerce*cpe:2.3:a:activecampaign:activecampaign_for_woocommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
activecampaign	activecampaign_for_woocommerce	*	cpe:2.3:a:activecampaign:activecampaign_for_woocommerce::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "ActiveCampaign for WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.9.8"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/6536946a-7ebf-4f8f-9446-36ec2a2a3ad2

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

25.4%

JSON

Related for CVE-2022-3923