PT-2022-23290 · Storeapps · Storeapps Affiliate For Woocommerce

Re-Alter + 1 · CVE-2022-36284 · Published 2022-08-05 · Updated 2022-08-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions StoreApps Affiliate For WooCommerce premium plugin versions <= 4.7.0

Description The issue allows an attacker to change the PayPal email due to an authenticated IDOR vulnerability. This can be exploited when the WooCommerce PayPal Payments plugin is installed, as it adds an extra input field on the user profile page.

Recommendations For StoreApps Affiliate For WooCommerce premium plugin versions <= 4.7.0, update to a version greater than 4.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the user profile page or removing the WooCommerce PayPal Payments plugin to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-36284

Affected Products

Storeapps Affiliate For Woocommerce

References · 5

• https://osv.dev/vulnerability/CVE-2022-36284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36284 · Security Note
• https://t.me/cibsecurity/47647 · Telegram Post
• https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-authenticated-idor-vulnerability-leading-to-paypal-email-change · Note
• https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt · Note