CVE-2022-0444 - OpenCVE

The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Watchful	Xcloner

Configuration 1 [-]

cpe:2.3:a:watchful:xcloner:*:*:*:*:*:wordpress:*:*

References

Link	Resource
https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: WPScan

Published: 2022-06-27T08:55:47

Updated: 2023-07-24T09:55:42.558Z

Reserved: 2022-02-01T00:00:00

Link: CVE-2022-0444

JSON object: View

NVD Information

Status : Modified

Published: 2022-06-27T09:15:08.390

Modified: 2023-11-07T03:41:18.260

Link: CVE-2022-0444

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:watchful:xcloner:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "5D872894-B1D5-4AFD-8F7B-1FFE5900CA5D", "versionEndExcluding": "4.3.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key."}, {"lang": "es", "value": "El plugin Backup, Restore and Migrate WordPress Sites With the XCloner Plugin de WordPress versiones anteriores a 4.3.6, no dispone de comprobaciones de autorizaci\u00f3n y de tipo CSRF cuando son restablecidos sus ajustes, lo que permite a atacantes no autenticados restablecerlos, incluyendo la generaci\u00f3n de una nueva clave de cifrado de la copia de seguridad"}], "id": "CVE-2022-0444", "lastModified": "2023-11-07T03:41:18.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-27T09:15:08.390", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}