CVE-2022-2260

 

Published at: - 01-08-2022 03:15

Last modified: - 05-08-2022 11:46

Total changes: - 2

Description

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://wpscan.com/vulnerability/831b3afa-8fa3-4cb7-8374-36d0c368292f

 

Keywords

NVD

 

CVE-2022-2260

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures