PT-2022-22577 · WordPress · Awesome Support

Dc11 · Published 2022-11-28 · Updated 2022-11-30 · CVE-2022-3511

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Awesome Support WordPress plugin versions prior to 6.1.2

Description The issue allows a low-privileged user, such as a subscriber, to download arbitrary exported tickets via an IDOR vector. This occurs because the plugin does not ensure that the exported tickets archive to be downloaded belongs to the user making the request.

Recommendations For versions prior to 6.1.2, update to version 6.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ticket export feature to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2022-3511

Affected Products

Awesome Support

References · 4

• 🔥 https://wpscan.com/vulnerability/9e57285a-0023-4711-874c-6e7b3c2673d1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3511 · Security Note
• https://t.me/cvenotify/38567 · Telegram Post