Strix
26.1K

CVE-2022-2260

MEDIUMCVSS 6.5/10EPSS 0.38%

Last modified

CVE-2022-2260 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.

Description

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Probability
0.38%

29.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GivewpGivewp< 2.21.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-2260?
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
How severe is CVE-2022-2260?
CVE-2022-2260 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.38% probability of exploitation in the next 30 days.
How do I fix CVE-2022-2260?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-2260?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST