CVE-2022-3154 (GCVE-0-2022-3154)

Vulnerability from cvelistv5 – Published: 2022-10-10 00:00 – Updated: 2024-08-03 01:00
VLAI?
Title
Multiple Plugins from Viszt Peter - Multiple CSRF
Summary
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
Severity ?
No CVSS data available.
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
TODO Woo Billingo Plus Affected: 4.4.5.4 , < 4.4.5.4 (custom)
Create a notification for this product.
Credits
Lana Codes
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.538Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Woo Billingo Plus",
          "vendor": "TODO",
          "versions": [
            {
              "lessThan": "4.4.5.4",
              "status": "affected",
              "version": "4.4.5.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Integration for Billingo \u0026 Gravity Forms",
          "vendor": "TODO",
          "versions": [
            {
              "lessThan": "1.0.4",
              "status": "affected",
              "version": "1.0.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Integration for Szamlazz.hu \u0026 Gravity Forms",
          "vendor": "TODO",
          "versions": [
            {
              "lessThan": "1.2.7",
              "status": "affected",
              "version": "1.2.7",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Lana Codes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo \u0026 Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu \u0026 Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin\u0027s license"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-10T00:00:00",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "url": "https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Plugins from Viszt Peter - Multiple CSRF",
      "x_generator": "WPScan CVE Generator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-3154",
    "datePublished": "2022-10-10T00:00:00",
    "dateReserved": "2022-09-07T00:00:00",
    "dateUpdated": "2024-08-03T01:00:10.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:woo_billingo_plus_project:woo_billingo_plus:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"4.4.5.4\", \"matchCriteriaId\": \"DB344D27-D79B-4564-8EAC-0267B2586973\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:integration_for_billingo_\\\\\u0026_gravity_forms_project:integration_for_billingo_\\\\\u0026_gravity_forms:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.0.4\", \"matchCriteriaId\": \"010CF706-3C08-4FDB-A08E-ACC4FFE2F5CA\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:integration_for_szamlazz.hu_\\\\\u0026_gravity_forms_project:integration_for_szamlazz.hu_\\\\\u0026_gravity_forms:*:*:*:*:*:wordpress:*:*\", \"versionEndExcluding\": \"1.2.7\", \"matchCriteriaId\": \"51AA6F7C-B2A6-4FCD-A532-F23843D16B78\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo \u0026 Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu \u0026 Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin\u0027s license\"}, {\"lang\": \"es\", \"value\": \"El plugin Woo Billingo Plus de WordPress versiones anteriores a 4.4.5.4, el plugin Integration for Billingo \u0026amp; Gravity Forms de WordPress versiones anteriores a 1.0.4 y el plugin Integration for Szamlazz.hu \u0026amp; Gravity Forms de WordPress versiones anteriores a 1.2.7 carecen de comprobaciones de tipo CSRF en varias acciones AJAX, lo que podr\\u00eda permitir a atacantes hacer que los administradores de tiendas registrados y superiores lleven a cabo acciones no deseadas, como desactivar la licencia del plugin\"}]",
      "id": "CVE-2022-3154",
      "lastModified": "2024-11-21T07:18:56.397",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 4.2}]}",
      "published": "2022-10-10T21:15:11.510",
      "references": "[{\"url\": \"https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd\", \"source\": \"contact@wpscan.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "contact@wpscan.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"contact@wpscan.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-3154\",\"sourceIdentifier\":\"contact@wpscan.com\",\"published\":\"2022-10-10T21:15:11.510\",\"lastModified\":\"2024-11-21T07:18:56.397\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo \u0026 Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu \u0026 Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin\u0027s license\"},{\"lang\":\"es\",\"value\":\"El plugin Woo Billingo Plus de WordPress versiones anteriores a 4.4.5.4, el plugin Integration for Billingo \u0026amp; Gravity Forms de WordPress versiones anteriores a 1.0.4 y el plugin Integration for Szamlazz.hu \u0026amp; Gravity Forms de WordPress versiones anteriores a 1.2.7 carecen de comprobaciones de tipo CSRF en varias acciones AJAX, lo que podr\u00eda permitir a atacantes hacer que los administradores de tiendas registrados y superiores lleven a cabo acciones no deseadas, como desactivar la licencia del plugin\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"contact@wpscan.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:woo_billingo_plus_project:woo_billingo_plus:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"4.4.5.4\",\"matchCriteriaId\":\"DB344D27-D79B-4564-8EAC-0267B2586973\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:integration_for_billingo_\\\\\u0026_gravity_forms_project:integration_for_billingo_\\\\\u0026_gravity_forms:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.0.4\",\"matchCriteriaId\":\"010CF706-3C08-4FDB-A08E-ACC4FFE2F5CA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:integration_for_szamlazz.hu_\\\\\u0026_gravity_forms_project:integration_for_szamlazz.hu_\\\\\u0026_gravity_forms:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"1.2.7\",\"matchCriteriaId\":\"51AA6F7C-B2A6-4FCD-A532-F23843D16B78\"}]}]}],\"references\":[{\"url\":\"https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd\",\"source\":\"contact@wpscan.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.