PT-2022-13492 · Google · Google Authenticator

Niraj Mahajan · Published 2022-06-27 · Updated 2022-07-07 · CVE-2022-0875

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Google Authenticator WordPress plugin versions prior to 1.0.5

Description The issue allows attackers to perform Cross-Site Scripting attacks by making a logged-in admin change settings without proper CSRF checks and input sanitization and escaping.

Recommendations For Google Authenticator WordPress plugin versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings page to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-0875

Affected Products

Google Authenticator

References · 3

• 🔥 https://wpscan.com/vulnerability/fefc1411-594d-465b-aeb9-78c141b23762 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0875 · Security Note