CVE-2022-2108

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-2108
The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359 Product
https://plugins.trac.wordpress.org/changeset/2742109 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2108 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wbcomdesigns:buddypress_group_reviews:*:*:*:*:*:wordpress:*:*
History

24 Oct 2023, 20:40

Type Values Removed Values Added
References (MISC) https://plugins.trac.wordpress.org/changeset/2742109 - Third Party Advisory (MISC) https://plugins.trac.wordpress.org/changeset/2742109 - Patch
References (MISC) https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359 - (MISC) https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359 - Product
References (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve - (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve - Third Party Advisory

20 Oct 2023, 16:15

Type Values Removed Values Added
References
  • (MISC) https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359 -
  • (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve -

24 Jul 2023, 13:08

Type Values Removed Values Added
CWE CWE-863 CWE-862

25 Jul 2022, 17:01

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:wbcomdesigns:buddypress_group_reviews:*:*:*:*:*:wordpress:*:*
First Time Wbcomdesigns
Wbcomdesigns buddypress Group Reviews
References (MISC) https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2108 - (MISC) https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2108 - Third Party Advisory
References (MISC) https://plugins.trac.wordpress.org/changeset/2742109 - (MISC) https://plugins.trac.wordpress.org/changeset/2742109 - Third Party Advisory

18 Jul 2022, 17:51

Type Values Removed Values Added
New CVE
Information

Published : 2022-07-18 17:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-2108

Mitre link : CVE-2022-2108

CVE.ORG link : CVE-2022-2108

JSON object : View

Products Affected

wbcomdesigns

  • buddypress_group_reviews
CWE
CWE-862

Missing Authorization