4.3
CVE-2022-1709
- EPSS 0.41%
- Veröffentlicht 08.06.2022 10:15:10
- Zuletzt bearbeitet 21.11.2024 06:41:17
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginThrows SPAM Away < 3.3.1 - Comment Deletion via CSRF
Throws SPAM Away <= 3.3 - Cross-Site Request Forgery to Comment Modification
The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack
Mögliche Gegenmaßnahme
Throws SPAM Away: Update to version 3.3.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gti ≫ Throws Spam Away SwPlatformwordpress Version < 3.3.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Throws SPAM Away
Version
[*, 3.3.1)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.41% | 0.327 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
https://wpscan.com/vulnerability/ac290535-d9ec-459a-abc3-27cd78eb54fc
https://www.wordfence.com/threat-intel/vulnerabilities/id/3ce0fece-a7e5-4d27-a70a-37ab0973c15f