CVE-2022-0287
Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure
Vexday Risk Score
3Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS —EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
25 abr 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
Productos afectados
Unknown · myCred