PT-2022-19041 · WordPress · Calendar Event Multi View

Mostafa Farzaneh + 1 · Published 2022-08-16 · Updated 2023-04-05 · CVE-2022-2846

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Calendar Event Multi View WordPress plugin versions prior to 1.4.07

Description The issue concerns a lack of authorization and CSRF checks when creating events, as well as insufficient sanitization and escaping in some event fields. This could allow unauthenticated attackers to create arbitrary events and inject Cross-Site Scripting payloads. The vulnerability can be exploited remotely, potentially leading to cross-site request forgery.

Recommendations For versions prior to 1.4.07, update to version 1.4.07 or later to resolve the issue. As a temporary workaround, consider restricting access to event creation functionality to minimize the risk of exploitation. Avoid using the plugin's event creation feature until the issue is resolved.

Exploit

Fix

Missing Authorization

XSS

CSRF

Weakness Enumeration

CWE-862

CWE-79

CWE-352

Related Identifiers

CVE-2022-2846

Affected Products

Calendar Event Multi View

References · 6

• 🔥 https://exploit-db.com/exploits/51241 · Exploit
• 🔥 https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2846 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2846 · Vendor Advisory
• http://packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html · Note
• https://t.me/cibsecurity/48236 · Telegram Post