{"containers": {"cna": {"affected": [{"product": "Multivendor Marketplace Solution for WooCommerce \u2013 WC Marketplace", "vendor": "Unknown", "versions": [{"lessThan": "3.8.12", "status": "affected", "version": "3.8.12", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "ptsfence"}], "descriptions": [{"lang": "en", "value": "The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-05T12:35:22", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/c600dd04-f6aa-430b-aefb-c4c6d554c41a"}], "source": {"discovery": "EXTERNAL"}, "title": "Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2022-2657", "STATE": "PUBLIC", "TITLE": "Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Multivendor Marketplace Solution for WooCommerce \u2013 WC Marketplace", "version": {"version_data": [{"version_affected": "<", "version_name": "3.8.12", "version_value": "3.8.12"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "ptsfence"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-862 Missing Authorization"}]}, {"description": [{"lang": "eng", "value": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/c600dd04-f6aa-430b-aefb-c4c6d554c41a", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/c600dd04-f6aa-430b-aefb-c4c6d554c41a"}]}, "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-2657", "datePublished": "2022-09-05T12:35:22", "dateReserved": "2022-08-04T00:00:00", "dateUpdated": "2022-09-05T12:35:22", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wc-marketplace:multivendor_marketplace_solution_for_woocommerce_-_wc_marketplace:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "EAE9C855-1A9F-42A4-BD46-8995F7A51FCD", "versionEndExcluding": "3.8.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF"}, {"lang": "es", "value": "El plugin Multivendor Marketplace Solution for WooCommerce de WordPress versiones anteriores a 3.8.12, carece de autorizaci\u00f3n y CSRF en m\u00faltiples acciones AJAX, lo que podr\u00eda permitir a cualquier usuario autenticado, como el suscriptor, llamarlos y suspender a vendedores (reportero por el remitente) o actualizar el estado de los pedidos de forma arbitraria (identificado por WPScan cuando verifica el problema), por ejemplo. Tambi\u00e9n son posibles otros ataques no autenticados, ya sea directamente o por medio de CSRF"}], "id": "CVE-2022-2657", "lastModified": "2022-09-08T20:19:55.333", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-05T13:15:08.477", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/c600dd04-f6aa-430b-aefb-c4c6d554c41a"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}], "source": "contact@wpscan.com", "type": "Secondary"}]}

{}