CVE-2022-2260: falha em GiveWP – Donation Plugin and Fundraising…
GiveWP < 2.21.3 - DoS via CSRF
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.4%
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
Produtos afetados
Unknown · GiveWP – Donation Plugin and Fundraising PlatformCVEs relacionadas — GiveWP – Donation Plugin and Fundraising…
No mesmo produto, das mais perigosas para as menos.
CVE-2021-25099—Give < 2.17.3 - Unauthenticated Reflected Cross-Site ScriptingEPSS 2.1%CVE-2022-0252—Give < 2.17.3 - Reflected Cross-Site Scripting via Import ToolEPSS 0.9%CVE-2021-25100—Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms DashboardEPSS 0.9%CVE-2022-2215—GiveWP < 2.21.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24524—GiveWP < 2.12.0 - Authenticated Stored XSSEPSS 0.6%