PT-2023-15040 · WordPress · Conversios All-In-One Google Analytics

Muhammad Daffa · Published 2023-03-01 · Updated 2023-03-08 · CVE-2022-46797

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin versions <= 5.2.3

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows for changes to the plugin settings. This can occur due to the lack of proper validation of requests, enabling an attacker to manipulate the plugin's configuration without the user's knowledge or consent.

Recommendations For versions <= 5.2.3, update to a version greater than 5.2.3 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-46797

Affected Products

Conversios All-In-One Google Analytics

References · 4

• https://osv.dev/vulnerability/CVE-2022-46797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46797 · Security Note
• https://t.me/cibsecurity/59230 · Telegram Post
• https://patchstack.com/database/vulnerability/enhanced-e-commerce-for-woocommerce-store/wordpress-actionable-google-analytics-and-google-shopping-plugin-for-woocommerce-plugin-5-2-3-cross-site-request-forgery-csrf?_s_id=cve · Note