PT-2022-22404 · Yoomoney · Yoomoney Юkassa Для Woocommerce

Ptsfence · Published 2022-08-23 · Updated 2023-06-29 · CVE-2022-34868

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YooMoney ЮKassa для WooCommerce plugin versions prior to 2.3.1

Description The issue allows for authenticated arbitrary settings update.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2022-34868

Affected Products

Yoomoney Юkassa Для Woocommerce

References · 4

• https://osv.dev/vulnerability/CVE-2022-34868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34868 · Security Note
• https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-authenticated-arbitrary-settings-update-vulnerability · Patch
• https://wordpress.org/plugins/yookassa/#developers · Note