CVE-2022-2387

{"id": "CVE-2022-2387", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-11-07T10:15:11.413", "references": [{"url": "https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack"}, {"lang": "es", "value": "El complemento de WordPress Easy Digital Downloads anterior a 3.0 no cuenta con verificaci\u00f3n CSRF al eliminar el historial de pagos y no garantiza que la publicaci\u00f3n que se eliminar\u00e1 sea en realidad un historial de pagos. Como resultado, los atacantes podr\u00edan hacer que un administrador que haya iniciado sesi\u00f3n elimine una publicaci\u00f3n arbitraria mediante un ataque CSRF."}], "lastModified": "2022-11-09T20:00:04.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sandhillsdev:easy_digital_downloads:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "C2EF547A-BB80-4DCB-A489-02E7CAD22CDE", "versionEndExcluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}