CVE-2022-2462mediumCWE-200

CVE-2022-2462: falha de média gravidade em oferwald Transposh WordPress Translation

Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Transposh WordPress Translation

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 5.3epss 3.8%
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
oferwald · Transposh WordPress Translation
CVEs relacionadas — oferwald Transposh WordPress Translation

No mesmo produto, das mais perigosas para as menos.

CVE-2022-2461MEDIUMTransposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings ChangeEPSS 5.1%CVE-2022-2536MEDIUMTransposh WordPress Translation <= 1.0.9.6 - Authorization BypassEPSS 1.5%