CVE-2022-2260: fallo en GiveWP – Donation Plugin and Fundraising…
GiveWP < 2.21.3 - DoS via CSRF
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.4%
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
Productos afectados
Unknown · GiveWP – Donation Plugin and Fundraising PlatformCVEs relacionadas — GiveWP – Donation Plugin and Fundraising…
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-25099—Give < 2.17.3 - Unauthenticated Reflected Cross-Site ScriptingEPSS 2.1%CVE-2022-0252—Give < 2.17.3 - Reflected Cross-Site Scripting via Import ToolEPSS 0.9%CVE-2021-25100—Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms DashboardEPSS 0.9%CVE-2022-2215—GiveWP < 2.21.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24524—GiveWP < 2.12.0 - Authenticated Stored XSSEPSS 0.6%