PT-2022-7179 · WordPress · Flatpm

Cydave · Published 2022-12-12 · Updated 2023-02-27 · CVE-2022-3934

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FlatPM WordPress plugin versions prior to 3.0.13

Description The issue exists due to the lack of protection of the web page structure. This could allow a remote attacker to conduct a cross-site scripting attack. The vulnerability is caused by the failure to sanitize and escape certain parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting. This could be used against high-privilege users, such as admins.

Recommendations For versions prior to 3.0.13, update to version 3.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected pages until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08733

CVE-2022-3934

Affected Products

Flatpm

References · 6

• 🔥 https://wpscan.com/vulnerability/ab68381f-c4b8-4945-a6a5-1d4d6473b73a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3934 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3934 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08733 · Security Note
• https://t.me/cibsecurity/54343 · Telegram Post
• https://t.me/cvenotify/45042 · Telegram Post