CVE-2022-3144

The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail=	Patch Third Party Advisory
https://wordpress.org/plugins/wordfence/#developers	Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3144	Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail=	Patch Third Party Advisory
https://wordpress.org/plugins/wordfence/#developers	Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3144	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wordfence:wordfence_security:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 07:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-09-23 14:15

Updated : 2024-11-21 07:18

NVD link : CVE-2022-3144

Mitre link : CVE-2022-3144

CVE.ORG link : CVE-2022-3144

JSON object : View

Products Affected

wordfence

wordfence_security

CWE

No CWE.

{"id": "CVE-2022-3144", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2022-09-23T14:15:12.900", "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail=", "tags": ["Patch", "Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://wordpress.org/plugins/wordfence/#developers", "tags": ["Release Notes"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3144", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail=", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wordpress.org/plugins/wordfence/#developers", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3144", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "descriptions": [{"lang": "en", "value": "The Wordfence Security \u2013 Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version."}, {"lang": "es", "value": "El plugin Wordfence Security - Firewall & Malware Scan para WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado en versiones hasta 7.6.0 incluy\u00e9ndola, por medio de una configuraci\u00f3n en la p\u00e1gina de opciones debido a un escape insuficiente en el valor almacenado. Esto hace posible que usuarios autenticados, con privilegios administrativos, inyecten scripts web maliciosos en la configuraci\u00f3n que es ejecutada cada vez que un usuario accede a una p\u00e1gina que muestra la configuraci\u00f3n afectada en los sitios que ejecutan una versi\u00f3n vulnerable."}], "lastModified": "2024-11-21T07:18:55.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wordfence:wordfence_security:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "FBBE93A3-2A94-4965-BDE1-3D19B2DB8777", "versionEndIncluding": "7.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}