5.3
CVE-2022-3891
- EPSS 0.66%
- Veröffentlicht 13.02.2023 15:15:14
- Zuletzt bearbeitet 21.03.2025 15:15:37
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginWP FullCalendar <= 1.4.1 - Missing Authorization to Information Disclosure
The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
Mögliche Gegenmaßnahme
WP FullCalendar: Update to version 1.5, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP FullCalendar
Version
*-1.4.1
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pixelite ≫ Wp Fullcalendar SwPlatformwordpress Version < 1.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.66% | 0.707 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|