Lucene search
HistoryDec 12, 2022 - 6:15 p.m.
CVE-2022-3999
dpd baltic shipping
wordpress plugin
authorisation
csrf
blog options
authenticated users
vulnerability
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS
0.001
Percentile
24.0%
The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
Affected configurations
Node
dpdgroupwoocommerce_shippingRange≤1.2.11wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| dpdgroup | woocommerce_shipping | * | cpe:2.3:a:dpdgroup:woocommerce_shipping:*:*:*:*:*:wordpress:*:* |
Related
prion
prion
Cross site request forgery (csrf)
2022-12-12 18:15:00
cvelist
cvelist
wpexploit
wpexploit
wpvulndb
wpvulndb
cve
cve
CVE-2022-3999
2022-12-12 18:15:12
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS
0.001
Percentile
24.0%
Related for NVD:CVE-2022-3999