PT-2022-14861 · Wbcom Designs · Buddypress Group Reviews

Marco Wotschka · Published 2022-07-18 · Updated 2023-10-24 · CVE-2022-2108

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wbcom Designs – BuddyPress Group Reviews for WordPress versions up to, and including, 2.8.3

Description The issue allows unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.

Recommendations For versions up to, and including, 2.8.3, update to a version that includes proper capability checks and nonce checks to prevent unauthorized modifications. As a temporary workaround, consider restricting access to the functions related to settings changes and review modification until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-2108

Affected Products

Buddypress Group Reviews

References · 7

• https://plugins.trac.wordpress.org/changeset/2742109 · Patch
• https://osv.dev/vulnerability/CVE-2022-2108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2108 · Security Note
• https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359 · Note
• https://t.me/cibsecurity/46468 · Telegram Post
• https://wordfence.com/vulnerability-advisories/#CVE-2022-2108 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve · Note