CVE-2022-3024: falha de média gravidade em Bitcoin Satoshi Tools : Faucets, Visitor…
Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi Games, Referral Program
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N