8.8

CVE-2022-0770

Exploit

Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 - Missing Authorization to Sensitive Information Disclosure

The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access to a logged in admin cookies by making them open a malicious link or page
Mögliche Gegenmaßnahme
Translate WordPress – Google Language Translator: Update to version 6.0.14, or a newer patched version
Translate WordPress with GTranslate: Update to version 2.9.9, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Translate WordPress – Google Language Translator
Version *-6.0.13
SystemWordPress Plugin
≫
Produkt Translate WordPress with GTranslate
Version [*, 2.9.9)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gtranslate ≫ Translate Wordpress With Gtranslate SwPlatformwordpress Version < 2.9.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.529
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.