CVE-2022-46797

2023-03-0114:15:16

CWE-352

[email protected]

web.nvd.nist.gov

cve

cross-site request forgery

conversios all-in-one google analytics

woocommerce plugin

plugin settings change

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.

Affected configurations

Nvd

Node

tatvicconversios.ioRange<5.2.4wordpress

VendorProductVersionCPE
tatvicconversios.io*cpe:2.3:a:tatvic:conversios.io:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
tatvic	conversios.io	*	cpe:2.3:a:tatvic:conversios.io::::::wordpress::*

References

patchstack.com/database/vulnerability/enhanced-e-commerce-for-woocommerce-store/wordpress-actionable-google-analytics-and-google-shopping-plugin-for-woocommerce-plugin-5-2-3-cross-site-request-forgery-csrf?_s_id=cve