Описание
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.6 (исключая)
cpe:2.3:a:qr_redirector_project:qr_redirector:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 30%
0.00112
Низкий
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-284
CWE-352
Связанные уязвимости
github
больше 3 лет назад
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
EPSS
Процентиль: 30%
0.00112
Низкий
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-284
CWE-352