CVE-2022-29419
Assigner: Patchstack
Published: 2022-04-25T00:00:00
State: PUBLISHED
affected: product: 3xSocializer (WordPress plugin)
vendor: Don Crowther
versions: lessThanOrEqual: 0.98.22
status: affected
version: <= 0.98.22
versionType: custom
credits: value: Vulnerability discovered by Lenon Leite (Patchstack Alliance)
datePublic: 2022-04-25T00:00:00
descriptions: value: SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a subscriber or higher.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 SQL Injection
type: CWE
solutions: value: Deactivate and delete. No patched version is available. This plugin hasn’t been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress. The last plugin version was released in the 2012 year.
source: discovery: EXTERNAL
title: WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerability
x_generator: engine: Vulnogram 0.0.9