CVE-2022-26254

Exploit

EPSS 0.18%
Published 27.03.2022 17:15:07
Last modified 21.11.2024 06:53:38
Source cve@mitre.org
Teams watchlist Login
Open Login

WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Wowonder ≫ Wowonder Version4.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.18%	0.404

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://youtu.be/b665r1ZfCg4

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2022-26254

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-26254

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-26254

EUVD