4.3

CVE-2022-1895

Exploit

underConstruction <= 1.19 - Cross-Site Request Forgery to Construction Mode Disabled

The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Mögliche Gegenmaßnahme
underConstruction: Update to version 1.20, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt underConstruction
Version [*, 1.20)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Underconstruction Project ≫ Underconstruction SwPlatformwordpress Version < 1.20
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.305
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.