CVE-2022-4905

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-4905
A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The patch is identified as 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a Patch
https://github.com/udx/wp-stateless/pull/630 Patch
https://github.com/udx/wp-stateless/releases/tag/3.2.0 Release Notes
https://vuldb.com/?ctiid.220750 Permissions Required
https://vuldb.com/?id.220750 Permissions Required
https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a Patch
https://github.com/udx/wp-stateless/pull/630 Patch
https://github.com/udx/wp-stateless/releases/tag/3.2.0 Release Notes
https://vuldb.com/?ctiid.220750 Permissions Required
https://vuldb.com/?id.220750 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:udx:stateless_media_plugin:3.1.1:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 07:36

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en UDX Stateless Media Plugin 3.1.1 en WordPress. Ha sido declarada problemática. Esta vulnerabilidad afecta a la función setup_wizard_interface del archivo lib/classes/class-settings.php. La manipulación de la configuración de los argumentos conduce a cross-site scripting. El ataque se puede iniciar de forma remota. La actualización a la versión 3.2.0 puede solucionar este problema. El parche se identifica como 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. Se recomienda actualizar el componente afectado. VDB-220750 es el identificador asignado a esta vulnerabilidad.
CVSS v2 : 4.0
v3 : 6.1 		v2 : 4.0
v3 : 3.5
References () https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a - Patch () https://github.com/udx/wp-stateless/commit/6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a - Patch
References () https://github.com/udx/wp-stateless/pull/630 - Patch () https://github.com/udx/wp-stateless/pull/630 - Patch
References () https://github.com/udx/wp-stateless/releases/tag/3.2.0 - Release Notes () https://github.com/udx/wp-stateless/releases/tag/3.2.0 - Release Notes
References () https://vuldb.com/?ctiid.220750 - Permissions Required () https://vuldb.com/?ctiid.220750 - Permissions Required
References () https://vuldb.com/?id.220750 - Permissions Required () https://vuldb.com/?id.220750 - Permissions Required

23 Feb 2023, 15:29

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-13 21:15

Updated : 2024-11-21 07:36

NVD link : CVE-2022-4905

Mitre link : CVE-2022-4905

CVE.ORG link : CVE-2022-4905

JSON object : View

Products Affected

udx

  • stateless_media_plugin
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')