CVE-2022-27231

Опубликовано: 13 июн. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.

Ссылки

https://jvn.jp/en/jp/JVN15241647/index.html
Release Notes
Third Party Advisory
https://wordpress.org/plugins/wp-statistics/
Product
Third Party Advisory
https://wordpress.org/plugins/wp-statistics/#developers
Release Notes
Third Party Advisory
https://jvn.jp/en/jp/JVN15241647/index.html
Release Notes
Third Party Advisory
https://wordpress.org/plugins/wp-statistics/
Product
Third Party Advisory
https://wordpress.org/plugins/wp-statistics/#developers
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*

Версия до 13.2.0 (исключая)

EPSS

Процентиль: 53%

0.00307

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-fxpc-rm7r-rgg9