CVE-2022-3082

miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

CVSS 6.5 MEDIUMEPSS 0.4%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

17 Oct 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Unknown · miniOrange Discord Integration

References

https://wpscan.com/vulnerability/a91d0501-c2a9-4c6c-b5da-b3fc29442a4f