7.1
CVE-2022-4745
- EPSS 0.09%
- Veröffentlicht 13.02.2023 15:15:19
- Zuletzt bearbeitet 03.04.2025 13:15:41
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginWP Customer Area <= 8.1.3 - Cross-Site Request Forgery
The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.
Mögliche Gegenmaßnahme
WP Customer Area: Update to version 8.1.4, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP Customer Area
Version
*-8.1.3
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wp-customerarea ≫ Wp Customer Area SwPlatformwordpress Version < 8.1.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.09% | 0.249 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.1 | 2.8 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|