2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"Multivendor Marketplace Solution for WooCommerce – WC Marketplace","vendor":"Unknown","versions":[{"lessThan":"3.8.12","status":"affected","version":"3.8.12","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wc-marketplace:multivendor_marketplace_solution_for_woocommerce_-_wc_marketplace:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"EAE9C855-1A9F-42A4-BD46-8995F7A51FCD","versionEndExcluding":"3.8.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF"},{"lang":"es","value":"El plugin Multivendor Marketplace Solution for WooCommerce de WordPress versiones anteriores a 3.8.12, carece de autorización y CSRF en múltiples acciones AJAX, lo que podría permitir a cualquier usuario autenticado, como el suscriptor, llamarlos y suspender a vendedores (reportero por el remitente) o actualizar el estado de los pedidos de forma arbitraria (identificado por WPScan cuando verifica el problema), por ejemplo. También son posibles otros ataques no autenticados, ya sea directamente o por medio de CSRF"}],"id":"CVE-2022-2657","lastModified":"2026-06-17T04:42:17.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-09-05T13:15:08.477","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c600dd04-f6aa-430b-aefb-c4c6d554c41a"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c600dd04-f6aa-430b-aefb-c4c6d554c41a"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}],"source":"contact@wpscan.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}
|