4.3

CVE-2022-1895

Exploit

underConstruction < 1.20 - Construction Mode Deactivation via CSRF

underConstruction <= 1.19 - Cross-Site Request Forgery to Construction Mode Disabled

The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Mögliche Gegenmaßnahme
underConstruction: Update to version 1.20, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Underconstruction Project ≫ Underconstruction SwPlatformwordpress Version < 1.20
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt underConstruction
Version [*, 1.20)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.327
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://wpscan.com/vulnerability/bd9ef7e0-ebbb-4b91-8c58-265218a3c536
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/da9b1132-fb02-443d-8d56-9e89658aad89
Third Party Advisory