« Volver al listado

CVE-2022-1843

Estado: ModificadaMedia (6.5)—

El plugin MailPress de WordPress versiones hasta 7.2.1, no presenta comprobaciones de tipo CSRF en varios lugares, lo que podría permitir a atacantes hacer que un administrador conectado cambie la configuración, purgue los archivos de registro y más por medio de ataques de tipo CSRF

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mailpress Project — Mailpress

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1843",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "MailPress",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.1",
              "versionType": "custom",
              "lessThanOrEqual": "7.2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-06-27T09:15:09.763",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/aa59f811-2375-4593-93d4-f587f9870ed1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/aa59f811-2375-4593-93d4-f587f9870ed1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks"
    },
    {
      "lang": "es",
      "value": "El plugin MailPress de WordPress versiones hasta 7.2.1, no presenta comprobaciones de tipo CSRF en varios lugares, lo que podría permitir a atacantes hacer que un administrador conectado cambie la configuración, purgue los archivos de registro y más por medio de ataques de tipo CSRF"
    }
  ],
  "lastModified": "2026-06-17T04:23:12.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mailpress_project:mailpress:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A12B5780-D3D0-4672-8B89-C9EF76BA9170",
              "versionEndIncluding": "7.2.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}