PT-2022-19605 · Unknown · Kubiq Cpt Base Plugin

Bee-K + 2 · Published 2022-05-20 · Updated 2022-05-26 · CVE-2022-29431

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions KubiQ CPT base plugin versions <= 5.8

Description A Cross-Site Request Forgery (CSRF) issue allows an attacker to delete the CPT base. This can be exploited by an attacker to manipulate requests, potentially leading to unauthorized actions on the affected system.

Recommendations For KubiQ CPT base plugin versions <= 5.8, update to a version higher than 5.8 to resolve the issue. As a temporary workaround, consider implementing additional validation checks for requests to prevent unauthorized actions. Restrict access to sensitive functionality to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-29431

Affected Products

Kubiq Cpt Base Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-29431 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29431 · Vendor Advisory
• https://wordpress.org/plugins/remove-cpt-base/#developers · Note
• https://patchstack.com/database/vulnerability/remove-cpt-base/wordpress-remove-cpt-base-plugin-5-8-cross-site-request-forgery-csrf-vulnerability-leading-to-cpt-base-deletion · Note
• https://t.me/cibsecurity/43101 · Telegram Post