CVE-2022-1967

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://wpscan.com/vulnerability/02d25736-c796-49bd-b774-66e0e3fcf4c9	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wp-championship_project:wp-championship:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2022-07-04 13:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-1967

Mitre link : CVE-2022-1967

CVE.ORG link : CVE-2022-1967

JSON object : View

Products Affected

wp-championship_project

wp-championship

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-1967", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-07-04T13:15:08.797", "references": [{"url": "https://wpscan.com/vulnerability/02d25736-c796-49bd-b774-66e0e3fcf4c9", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues"}, {"lang": "es", "value": "El plugin WP Championship de WordPress versiones anteriores a 9.3, carece de comprobaciones de tipo CSRF en varios lugares, lo que permite a atacantes hacer que un administrador con sesi\u00f3n iniciada lleve a cabo acciones no deseadas, como crear y eliminar equipos arbitrarios, as\u00ed como actualizar la configuraci\u00f3n del plugin. Debido a una falta de saneo y escape, tambi\u00e9n podr\u00eda conllevar a problemas de tipo Cross-Site Scripting Almacenado"}], "lastModified": "2022-07-12T18:32:38.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wp-championship_project:wp-championship:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "47A6DA9A-1BDA-47FE-9881-B018853AEB31", "versionEndExcluding": "9.3"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}