8.8
CVE-2022-1672
- EPSS 0.6%
- Veröffentlicht 17.07.2022 11:15:08
- Zuletzt bearbeitet 21.11.2024 06:41:13
- CVE-Watchlists
- Unerledigt
LoginInsights from Google PageSpeed < 4.0.7 - Multiple CSRF
Insights from Google PageSpeed <= 4.0.6 - Multiple Cross-Site Request Forgery
The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks
Mögliche Gegenmaßnahme
Insights from Google PageSpeed: Update to version 4.0.7, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Insights From Google Pagespeed Project ≫ Insights From Google Pagespeed SwPlatformwordpress Version < 4.0.7
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Insights from Google PageSpeed
Version
*-4.0.6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.6% | 0.445 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| NIST | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
https://wpscan.com/vulnerability/5c5955d7-24f0-45e6-9c27-78ef50446dad
https://www.wordfence.com/threat-intel/vulnerabilities/id/c8440240-f652-4372-9ed8-f3eb3b8336e0