Lucene search

VulDBCVE-2022-3941

HistoryNov 11, 2022 - 7:15 a.m.

CVE-2022-3941

2022-11-1107:15:14

CWE-707

CWE-116

VulDB

web.nvd.nist.gov

vulnerability

activity log plugin

cve-2022-3941

critical

http header handler

x-forwarded-for

remote attack

improper output neutralization

vdb-213448

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213448.

Affected configurations

Nvd

Node

activity_log_projectactivity_logMatch-wordpress

VendorProductVersionCPE
activity_log_projectactivity_log-cpe:2.3:a:activity_log_project:activity_log:-:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
activity_log_project	activity_log	-	cpe:2.3:a:activity_log_project:activity_log:-:::::wordpress::

CNA Affected

[
  {
    "vendor": "unspecified",
    "product": "Activity Log Plugin",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

References

drive.google.com/file/d/1x-pgK3_-uS7NWfkEt_tk4Wc9FhXk-pYX/view

drive.google.com/file/d/1YNOLomPC95rRvtk0topUhStVIa7Y8lcq/view

vuldb.com/?id.213448

Social References

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

Related for CVE-2022-3941