CVE-2022-3154

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd	Exploit Third Party Advisory
https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:woo_billingo_plus_project:woo_billingo_plus:*:*:*:*:*:wordpress:*:*

Configuration 2 (hide)

cpe:2.3:a:integration_for_billingo_\&_gravity_forms_project:integration_for_billingo_\&_gravity_forms:*:*:*:*:*:wordpress:*:*

Configuration 3 (hide)

cpe:2.3:a:integration_for_szamlazz.hu_\&_gravity_forms_project:integration_for_szamlazz.hu_\&_gravity_forms:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 07:18

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd - Exploit, Third Party Advisory

Information

Published : 2022-10-10 21:15

Updated : 2024-11-21 07:18

NVD link : CVE-2022-3154

Mitre link : CVE-2022-3154

CVE.ORG link : CVE-2022-3154

JSON object : View

Products Affected

integration_for_billingo_\&_gravity_forms_project

integration_for_billingo_\&_gravity_forms

integration_for_szamlazz.hu_\&_gravity_forms_project

integration_for_szamlazz.hu_\&_gravity_forms

woo_billingo_plus_project

woo_billingo_plus

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-3154", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2022-10-10T21:15:11.510", "references": [{"url": "https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license"}, {"lang": "es", "value": "El plugin Woo Billingo Plus de WordPress versiones anteriores a 4.4.5.4, el plugin Integration for Billingo & Gravity Forms de WordPress versiones anteriores a 1.0.4 y el plugin Integration for Szamlazz.hu & Gravity Forms de WordPress versiones anteriores a 1.2.7 carecen de comprobaciones de tipo CSRF en varias acciones AJAX, lo que podr\u00eda permitir a atacantes hacer que los administradores de tiendas registrados y superiores lleven a cabo acciones no deseadas, como desactivar la licencia del plugin"}], "lastModified": "2024-11-21T07:18:56.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:woo_billingo_plus_project:woo_billingo_plus:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "DB344D27-D79B-4564-8EAC-0267B2586973", "versionEndExcluding": "4.4.5.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:integration_for_billingo_\\&_gravity_forms_project:integration_for_billingo_\\&_gravity_forms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "010CF706-3C08-4FDB-A08E-ACC4FFE2F5CA", "versionEndExcluding": "1.0.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:integration_for_szamlazz.hu_\\&_gravity_forms_project:integration_for_szamlazz.hu_\\&_gravity_forms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "51AA6F7C-B2A6-4FCD-A532-F23843D16B78", "versionEndExcluding": "1.2.7"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}