CVE-2022-1577

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule

CVSS v3 5.4 MEDIUM
CVSS v2.0 5.8 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346	Exploit Third Party Advisory
https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deliciousbrains:database_backup:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 06:41

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346 - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346 - Exploit, Third Party Advisory

Information

Published : 2022-06-08 10:15

Updated : 2024-11-21 06:41

NVD link : CVE-2022-1577

Mitre link : CVE-2022-1577

CVE.ORG link : CVE-2022-1577

JSON object : View

Products Affected

deliciousbrains

database_backup

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-1577", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2022-06-08T10:15:09.843", "references": [{"url": "https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule"}, {"lang": "es", "value": "El plugin Database Backup para WordPress versiones anteriores a 2.5.2, no presenta una comprobaci\u00f3n de tipo CSRF cuando es actualizada la configuraci\u00f3n de las copias de seguridad programadas, lo que podr\u00eda permitir a un atacante hacer que un administrador conectado las cambie por medio de un ataque de tipo CSRF. Esto podr\u00eda conllevar casos en los que los atacantes puedan enviarse a s\u00ed mismos correos electr\u00f3nicos de notificaci\u00f3n de copias de seguridad, que contienen m\u00e1s detalles. O deshabilitar la programaci\u00f3n de copias de seguridad autom\u00e1ticas"}], "lastModified": "2024-11-21T06:41:00.253", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deliciousbrains:database_backup:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "EF7D8057-9485-4A36-A93D-375E1C7FC8DA", "versionEndExcluding": "2.5.2"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}