PT-2022-13957 · WordPress · Uleak Security & Monitoring

Splint3R7 · Published 2022-05-16 · Updated 2022-05-25 · CVE-2022-1557

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ULeak Security & Monitoring WordPress plugin versions prior to 1.2.4

Description The issue concerns a lack of authorization and CSRF checks when updating settings, as well as insufficient sanitization and escaping in certain settings. This could allow authenticated users, such as subscribers, to perform Stored Cross-Site Scripting attacks against administrators viewing the settings.

Recommendations For ULeak Security & Monitoring WordPress plugin versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings update functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1557

Affected Products

Uleak Security & Monitoring

References · 4

• 🔥 https://wpscan.com/vulnerability/e2b6dbf5-8709-4a2c-90be-3214ff55ed56 · Exploit
• 🔥 https://packetstormsecurity.com/files/166564 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1557 · Security Note